RE: mac address in data vlan - drop

Cisco issue. Freeradius is sending back access-accept. Your issue sounds familiar to something I've seen with pass through before. Verify the behaviour with a change to the auth type on the switch eg multi-host alan