Juniper Netscreen: OSPF in Untrust zone

I am having a problem setting up OSPF between a Juniper Netscreen SSG5's "Untrust" zone and a Cisco router in a lab environment. The state does not transition past EXSTART until the Netscreen device's interface is placed into the "Trust" zone. The below configuration is exactly as entered after clearing all configuration on both devices.

GNS3 emulated Cisco 3640 with IOS 12.4(23)

configure terminal
interface fastethernet0/0
ip address 172.16.1.1 255.255.255.252
no shutdown
router ospf 1
network 172.16.1.1 0.0.0.0 area 1
default-info originate always

Juniper SSG5 with ScreenOS 6.2.0r5.0

set interface ethernet0/0 ip 172.16.1.2 255.255.255.252
set vrouter trust-vr protocol ospf
set vrouter trust-vr protocol ospf enable
set vrouter trust-vr protocol ospf area 1
set interface ethernet0/0 protocol ospf area 1
set interface ethernet0/0 protocol ospf enable

Once these commands are entered, issuing this command on the Netscreen

 get vrouter trust-vr protocol ospf neighbor

results in

            Neighbor(s) on interface ethernet0/0 (Area 0.0.0.1)
IpAddr/IfIndex  RouterId        Pri State    Opt  Up           StateChg
------------------------------------------------------------------------------
172.16.1.1      172.16.1.1        1 ExStart  E    00:01:26     (+4 -0)

On the Cisco

show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.1.2        1   EXCHANGE/BDR    00:00:38    172.16.1.2      FastEthernet0/0

As soon as I enter the following command on the Netscreen, the state transitions to FULL

set interface ethernet0/0 zone Trust

Here's the debug output on the Cisco

debug ip ospf adj

*Mar  1 00:02:18.971: OSPF: 2 Way Communication to 172.16.1.2 on FastEthernet0/0, state 2WAY
*Mar  1 00:02:18.971: OSPF: Backup seen Event before WAIT timer on FastEthernet0/0
*Mar  1 00:02:18.971: OSPF: DR/BDR election on FastEthernet0/0
*Mar  1 00:02:18.971: OSPF: Elect BDR 172.16.1.1
*Mar  1 00:02:18.971: OSPF: Elect DR 172.16.1.2
*Mar  1 00:02:18.971: OSPF: Elect BDR 172.16.1.1
*Mar  1 00:02:18.971: OSPF: Elect DR 172.16.1.2
                             DR: 172.16.1.2 (Id)   BDR: 172.16.1.1 (Id)
*Mar  1 00:02:18.971: OSPF: Send DBD to 172.16.1.2 on FastEthernet0/0 seq 0x2212 opt 0x52 flag 0x7 len 32
*Mar  1 00:02:23.971: OSPF: Send DBD to 172.16.1.2 on FastEthernet0/0 seq 0x2212 opt 0x52 flag 0x7 len 32
*Mar  1 00:02:23.971: OSPF: Retransmitting DBD to 172.16.1.2 on FastEthernet0/0 [1]
*Mar  1 00:02:24.003: OSPF: Rcv DBD from 172.16.1.2 on FastEthernet0/0 seq 0x436 opt 0x2 flag 0x7 len 32  mtu 1500 state EXSTART
*Mar  1 00:02:24.003: OSPF: NBR Negotiation Done. We are the SLAVE
*Mar  1 00:02:24.003: OSPF: Send DBD to 172.16.1.2 on FastEthernet0/0 seq 0x436 opt 0x52 flag 0x2 len 72
*Mar  1 00:02:24.003: OSPF: Rcv DBD from 172.16.1.2 on FastEthernet0/0 seq 0x436 opt 0x2 flag 0x7 len 32  mtu 1500 state EXCHANGE
(last two lines repeat indefinitely)

I don't think it is an MTU mismatch, both devices are set to 1500. And, like I said, it works once the Netscreen interface is placed into the "Trust" zone.

Entering the following on the Netscreen doesn't appear to change anything.

set policy default-permit-all 
unset policy 1

A Wireshark capture shows a flurry of ICMP TTL exceeded packets from the Netscreen to the Cisco when the Netscreen interface is in the "Untrust" zone.

For what it's worth, iBGP works in the "Untrust" zone.