When a phone is on the voice vlan packet destined for it should have a 802.1q tag with a VLAN ID of the voice vlan.
Does the EAP packet (for the phone) have an 802.1q vlan header when using 802.1X MDA? What about re-authentication packets?
The Standard says VLAN tagging is not supported but it was not written with MDA in mind.