OK, part of the mystery solved: the TCP RST comes from a /different/ machine then the one I was running tcpdump on. I didn't use -e because I didn't expect anyone else to answer on that VLAN.