Spark policy install issue

[StevePearson]

I have a centrally managed Spark 1555, that appears to have suddenly stopped installing policies correctly or doing something strange when it installs a policy!

With everything working normally on the Spark and I push a policy to it, it received the policy (verified in the web GUI) but as it installs the device stops passing traffic. Once in that state, the only way I can get it working again is to reboot it. Unloading the policy from the CLI does not help!

For testing I have a constant ping running so that I can see when it stops. When it stops, I can ping the same IP successfully from the CLI, so the internet connection is working correctly.

Now I know the instant thought is that the policy is doing something nasty, but I think there is something more serious going on, especially as unloading the policy isn't helping. I can simply push the policy with no changes, and everything stops. I can use the Fetch Policy button in the web GUI, everything stops. I can use the CLI command "fw fetchlocal" and it reports install succeeded then a few seconds later everything stops. 

In the failed state zdebug shows no drops, fw monitor shows the outbound traffic but nothing back in. Tracert doesn't show anything past the gateway, not even the ISP default gateway. (this is a PPPoE connection)

A reboot, from the CLI or the GUI, or a power cycle fixes it again until the next time. 

Can anyone suggest what could cause this please?