Packet mangling utilities besides iptables?

I haven't used it, but the QUEUE netfilter target looks like it might work. It uses an nflink socket and a userspace application registered to the socket to perform the payload modifications.

The libipq man page contains details on how to use this and provides a simple example.

Resolution:

We ended up with a custom module for netfilter, which is clearly the "right" tool for the job.