Finally got to the bottom of the issue. I had overlooked the fact that DHCP snooping and ARP inspection were turned up at the global level on the switch. Since the trunk port to the AP did not have the trust statements for ARP inspection and DHCP snooping the ARP requests from the client were getting dropped at the switch. The weird issue and what was throwing every one off the trail was that the debug traces were showing the traffic getting dropped on the client AP (more correctly not being routed properly). Had we seen the traffic on the server AP it would have pointed me in the right direction sooner.
So with this I can confirm that the new hardware and firmware up to 8.4r9a does work for a layer 2 VPN.
