I imaged Labvirt1012, 1013 and 1014 with the 4.4.0-28-generic kernel. Everything looked to be working fine, but after some exhaustive tests we determined that IPtables were totally ignoring any of the rules set by openstack security-groups... our VMs were entirely without firewalls.
It's yet unclear if that means that iptables are 100% broken with that kernel or if it's some complex interaction with nova-compute, but either way this is a major deal breaker for that kernel and needs more investigation.