Yes I was aware of the *.iface files. However, I do have /var/run/resolv.conf on my N900 ... which is populated by udhcpc when i connect to my work Wi-Fi (WPA-Enterprise .. where Maemo's wlancond fails)

In any case, dnsmasq looks in all /var/run/resolv.conf.*

That libicd script is probably called by icd2 when the connection has been successfully established ... i don't believe you will get anywhere with icd2 as it's closed-source (or i'm wrong?). icd2 is responsible for the network connections you select on the connection list (where your vpn will not be)

You can see the foregoing with 'ps ax | grep udhcpc' ... and that script is used as the config file ... nothing special involved there

can you not just call udhcpc yourself after your vpn connection has been established? that's what i do with wpa_supplicant for my scenario above
Of course this honors dnsmasq as it doesn't touch /etc/resolv.conf