According to the ethdev doc, in general, PMD tx_burst() should not modify mbuf
contents. To be more specific:

ethdev/rte_ethdev.h:6396
...
 * @note This function must not modify mbufs (including packets data)
 * unless the refcnt is 1.
 * An exception is the bonding PMD, which does not have "Tx prepare" support,
 * in this case, mbufs may be modified.
...

Though why looking at eth_af_packet_tx(), it looks to me like it does modify
the packet contents without any checks for refcnt, etc.:

static uint16_t
eth_af_packet_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
{
        ...
        for (i = 0; i < nb_pkts; i++) {
                mbuf = *bufs++;

                ...

                /* insert vlan info if necessary */
                if (mbuf->ol_flags & RTE_MBUF_F_TX_VLAN) {
                        if (rte_vlan_insert(&mbuf)) {
                                rte_pktmbuf_free(mbuf);
                                continue; 

AFAIU, it does copy of mbuf contents into pbuf anyway (just few line below).
So the fix might be - simply insert VLAN tag at copying stage.
Feel free to correct me, if I missed something.