VPN client injects a route that silently steals the return path for one private subnet

General connectivity remains healthy, but one internal subnet breaks because the host routing table now prefers a path injected by a VPN client.