ok nailed it, the issue is the default hosts.allow installed on
FreeBSD, and specifically the last section that denies everything. By
default it looks like this:
# The rest of the daemons are protected.
ALL : ALL \
: severity auth.info \
: twist /bin/echo "You are not welcome to use %d from %h."
The twist command breaks it. In theory this is just meant to send a
custom message back to the application calling the tcp wrapper
library. I'm not sure if this should work in theory or not, but the
twist command is also meant to close the connection so possibly the
behaviour I see is normal and just not compatible with MySQL.
Anyway, its not a great default for FreeBSD given that MySQL also
installs by default with support for tcp wrappers. The two together
results in a broken configuration.