This is made doubly frustrating by the fact that AT&T does not allow you to use your own router.

You can put your own router behind the AT&T gateway and then tell the gateway it's a DMZ.

AT&T does a lot to make me angry, but removing uPnP is the right call IMHO.

Using DMZ doesn't completely solve my problem, the AT&T gateway is still routing every packet (at less than line speed) and randomly dropping some of them.