Transactional replication reports ok, but tracer token not arriving
Ok, in case anyone ever has this problem I found the fix (though not the root cause).

Fix


Stop the distribution agents for all subscribers to publications from this database
Get the LSN that is causing the problem from one of the subscribers: 


SELECT 
        publication, 
        '0x' + CONVERT(VARCHAR(32),MAX(transaction_timestamp),2) as LastPubLSN 
    FROM 
        dbo.MSreplication_subscriptions 
    GROUP BY publication


Find a valid LSN to start from:


DECLARE @Publisher sysname = N'PubA',
            @PubDB sysname = N'DB2',
            @Publication sysname = N'PushPub_Broken';
    SELECT TOP 1000 trans.entry_time, trans.publisher_database_id, trans.xact_seqno
        FROM dbo.MSpublications AS p
            JOIN master..sysservers AS srv
                ON srv.srvid = p.publisher_id
            JOIN dbo.MSpublisher_databases AS d
                ON d.publisher_id = p.publisher_id
                AND d.publisher_db = p.publisher_db
            JOIN dbo.MSrepl_transactions AS trans
                ON trans.publisher_database_id = d.id
        WHERE p.publication = @Publication
              AND p.publisher_db = @PubDB
              AND srv.srvname = @Publisher
              AND trans.xact_seqno &gt;= p.min_autonosync_lsn
    ORDER BY trans.entry_time DESC


Check what invalid commands are in the repl queue:


DECLARE @PubDB INT = 5  /* use the publisher_database_id retrieved above */
    select * from MSrepl_commands with (READPAST)
              where 
                 publisher_database_id = @PubDB and
                 command_id = 1 and
                 type &lt;&gt; 30 and  /* 30 = normal repl commands */
                 type &lt;&gt; -2147483611 /* -2147483611 = is ignored by sp_MSget_repl_commands (it's snapshot related?) */


Backup and delete the commands that are causing the blocking, this should be the same LSN that is causing the problem (see step 2)
Reset the LSN on each of the subscriber DBs


EXEC sp_setsubscriptionxactseqno 
        @publisher = 'PubA',
        @publisher_db = 'DB2',
        @publication = 'PushPub_Broken',
        @xact_seqno = 0x0000...  /* New valid LSN to start from (step 3) */


Start up your distribution agent and verify that all is working.


How I found it

So after finding and trialling sp_setsubscriptionxactseqno in conjunction with knowing how to get the LastLSN applied to the subscriber, I ran a trace on the distributor, I was able to see that the sequence was:

exec sp_MSget_repl_commands 126,/* good LSN that I was telling it to use */,0,10000000
go
exec sp_MShelp_distribution_agentid 6,N'PushPub_broken',N'DB2',8,N'PushBroken2',0
go
exec sp_MSget_repl_commands 126,/* bad LSN that it was resetting too */,0,10000000
go


Running the first command myself, I could see 2 resultsets returned, the 2nd of which included the bad LSN.  Obviously something inside this proc was causing it to overwrite the LSN I wanted it to apply.

Finding the code to sp_MSget_repl_commands, I was able to identify that it was:

select @max_xact_seqno = max(xact_seqno) from MSrepl_commands with (READPAST)
  where 
     publisher_database_id = @publisher_database_id and
     command_id = 1 and
     type &lt;&gt; -2147483611 


From there, I found the culprit records and was able to restart replication (after resyncing my data)