vn-tag comes after ethernet dst map and before vlan tags.
It's 6 bytes long and there is no easy way to skip it with existing bpf.
It would be good to add a vntag keyword that can skip 6 bytes like vlan skips 4.