Linux – PRIO qdisc example not working

I have a TP-Link WR1043-ND with OpenWrt 12.09 (r36088, Linux 3.3.8). There is a bridge called br-lan joining eth0.1 (tagged VLAN for the 4 LAN ports) and wlan0 (Wi-Fi). There is also the WAN port at eth0.2. For the moment I want to try an example in the LARTC to classify the SSH packets inside the bridge so they get priority over other traffic. My computer is connected directly to the router to br-lan for measuring, and there is nothing else in between, or in any of the router ports.

This is my qdisc setup before doing anything:

qdisc pfifo_fast 0: dev eth0 root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc mq 0: dev wlan0 root

No iptables rules, all flushed and default policy ACCEPT.

Here is the relevant paragraph of the LARTC, section 9.5.3.2:

We will create this tree:

     1:   root qdisc
    / | \ 
  /   |   \
  /   |   \
1:1  1:2  1:3    classes
 |    |    |
10:  20:  30:    qdiscs    qdiscs
sfq  tbf  sfq

band 0 1 2
Bulk traffic will go to 30:, interactive traffic to 20: or 10:.

Command lines:

# tc qdisc add dev eth0 root handle 1: prio<br>
This *instantly* creates classes 1:1, 1:2, 1:3
# tc qdisc add dev eth0 parent 1:1 handle 10: sfq<br>
# tc qdisc add dev eth0 parent 1:2 handle 20: tbf rate 20kbit buffer 1600 limit 3000
# tc qdisc add dev eth0 parent 1:3 handle 30: sfq                                

Now let's see what we created:

# tc -s qdisc ls dev eth0
qdisc sfq 30: quantum 1514b
Sent 0 bytes 0 pkts (dropped 0, overlimits 0)

qdisc tbf 20: rate 20Kbit burst 1599b lat 667.6ms 
Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 

 qdisc sfq 10: quantum 1514b 
 Sent 132 bytes 2 pkts (dropped 0, overlimits 0) 

 qdisc prio 1: bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 174 bytes 3 pkts (dropped 0, overlimits 0) 

This is my qdisc setup after running the commands above, obtained running tc qdisc show:

qdisc pfifo_fast 0: dev eth0 root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc prio 1: dev br-lan root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc sfq 10: dev br-lan parent 1:1 limit 127p quantum 1514b depth 127 divisor 1024
qdisc tbf 20: dev br-lan parent 1:2 rate 20000bit burst 1600b lat 560.0ms
qdisc sfq 30: dev br-lan parent 1:3 limit 127p quantum 1514b depth 127 divisor 1024
qdisc mq 0: dev wlan0 root

Sample output of tc -s qdisc ls dev br-lan:

qdisc prio 1: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 52544 bytes 528 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0
qdisc sfq 10: parent 1:1 limit 127p quantum 1514b depth 127 divisor 1024
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0
qdisc tbf 20: parent 1:2 rate 20000bit burst 1600b lat 560.0ms
 Sent 23492 bytes 206 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0
qdisc sfq 30: parent 1:3 limit 127p quantum 1514b depth 127 divisor 1024
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0

My ssh packets are misclassified and all get sent to 20:. Same with scp packets, and everything else in fact.

If I understand correctly, PRIO looks at the TOS field to know which band to set a packet to, and according to the priomap, packets with TOS 0x10 (SSH) should get sent to the band 0 (10:) and these with TOS 0x08 (SCP) should end up in band 2 (30:). I have confirmed the packets have the TOS set properly by looking in wireshark on my computer, and also that the TOS makes it to the router by looking at tcpdump output inside the router. But everything still ends up in 20:.

Any ideas as to why?

Thanks in advance.