Hi Tamas,
I've got the vpn client going over ethernet but not yet over the hso device.
I found 2 idiotic substantial bugs in the vpn client one which caused
the crash in linuxcniapi.c as you were seeing
You'll note that in some places the code was looping to <MAX_INTERFACES
& other places to <=MAX_INTERFACES, this was flying over the edge
of the array.
These bugs are not unique to the hso driver they just happened to
manifest there.

Let me know if you still find crashes somehow, post them to me & more importantly
let me know if you get hso going over vpn.

Please find some way to get the bugfixes back to Cisco.

-- 
best regards,
D.J. Barrow