That is how I had it set up, but it turns out the problem was in the driver's seat anyway. (What do you know, it helps to bother to read the documentation about the protocol you're trying to tcpdump before you do it.) Turned out what I thought was Netatalk spewing broadcasts was actually the Plus spewing requests for a file server to answer; Netatalk wasn't actually talking DDP. Two minutes of digging revealed that the problem was that the Ubuntu /etc/init.d/netatalk startup script has atalkd specifically disabled by default. After enabling that I got the Plus working apparently fine.
(It took one more tweak to the afpd config to enable plain-text passwords. In retrospect I'm still not sure why the prebuilt VM I got for the a2server *didn't* work out of the box since I'd assume that the config on that would enable atalkd, but no matter. Probably had some other confounding issue, don't care right now. I did get this all working with a physical machine as the server instead of Virtualbox on OS X, just to remove another variable.)
Tomorrow hopefully I'll be able to actually get some software transferred over to disks so the 512k can be a slightly more *interesting* conversation piece/paperweight.