There are two different ways that applications can use direwolf as a TNC.
(1) As a stupid KISS TNC. In this case the application is totally in control. The stupid TNC just does what it is told. Decisions about PACLEN, MAXFRAME, etc. are made entirely by the application layer. (Or AX.25 for Linux if that is in the middle.)
(2) The AGW network interface allows direwolf to perform the link layer (connected mode) function. In this case the direwolf configuration has the usual PACLEN, MAXFRAME, etc.
This block diagram illustrates how the AGW network interface can access more functionality inside the TNC. https://github.com/wb2osz/direwolf/blob/master/direwolf-block-diagram.png It is advantageous to use that interface if your application supports it.
This application note https://github.com/wb2osz/direwolf/raw/dev/doc/Why-is-9600-only-twice-as-fast-as-1200.pdf explains the differences between using the AX.25 link layer built in to direwolf or having the application treat it as a stupid KISS TNC.
Back to your question. We need to run a test to see what is going on. Run direwolf with these options:
direwolf -d nao -T %T 2>&1 | tee w.log
This will capture information about the conversation between your application and direwolf. It will also print information about Carrier Detect and PTT so we can see how many frames are in each transmission. The -T option will add timestamps. Finally it is all captured in a file so we can examine it later.