We found one case when it does work (for both Crux and 1.3), which can lead to further investigation: when the policy is applied to a PPPoE client interface and the class traffic is matched with the command naming the subinterface (the first of the 3 options above).