Obviously the wise DNN gurus in this forum decided that it would be more instructive to let me work this out on my own than lend a hand.

It appears that applying a charge to a security role, paid for by paypal, doesn't work properly in 4.1.1
The reason appears to be that, the IPN reciever code doesn't format the form to post back to Paypal properly, resulting in invalid response codes.
Here's how to fix it:

I don't know why but the line:
strPost += String.Format("&{0}={1}", strName, HTTPPOSTEncode(strValue))

in the main loop in Sub Page_Load in admin/sales/PayPalIPD.aspx.vb mixes up the order in which the form elements are posted back, which paypal doesn't like. Comment out that line and add this:

strPost = Request.Form.ToString() 'Create the string to post back to PayPal system to validate
strPost &= "&cmd=_notify-validate"

after the loop.

Thanks to http://www.wwwcoder.com/main/parentid/263/site/2569/68/default.aspx for the tip.

The final sub should read (setup for paypal's sandbox):

Private Sub Page_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Try
Dim strName As String
Dim objStream As StreamWriter
Dim blnValid As Boolean = True
Dim strTransactionID As String
Dim strTransactionType As String
Dim intRoleID As Integer
Dim intPortalID As Integer = PortalSettings.PortalId
Dim intUserID As Integer
Dim strDescription As String
Dim dblAmount As Double
Dim strEmail As String
Dim strBody As String
Dim blnCancel As Boolean = False
Dim strPayPalID As String

Dim objRoles As New RoleController
Dim objPortalController As New PortalController

Dim strPost As String = "cmd=_notify-validate"
For Each strName In Request.Form
Dim strValue As String = Request.Form(strName)
Select Case strName
Case "txn_type" ' get the transaction type
strTransactionType = strValue
Select Case strTransactionType
Case "subscr_signup", "subscr_payment", "web_accept"
Case "subscr_cancel"
blnCancel = True
Case Else
blnValid = False
End Select
Case "payment_status" ' verify the status
If strValue <> "Completed" Then
blnValid = False
End If
Case "txn_id" ' verify the transaction id for duplicates
strTransactionID = strValue
Case "receiver_email" ' verify the PayPalId
strPayPalID = strValue
Case "mc_gross" ' verify the price
dblAmount = Double.Parse(strValue)
Case "item_number" ' get the RoleID
intRoleID = Int32.Parse(strValue)
Dim objRole As RoleInfo = objRoles.GetRole(intRoleID, intPortalID)
Case "item_name" ' get the product description
strDescription = strValue
Case "custom" ' get the UserID
intUserID = Int32.Parse(strValue)
Case "email" ' get the email
strEmail = strValue
End Select
' reconstruct post for postback validation
'strPost += String.Format("&{0}={1}", strName, HTTPPOSTEncode(strValue))
Next

strPost = Request.Form.ToString() 'Create the string to post back to PayPal system to validate
strPost &= "&cmd=_notify-validate"

' postback to verify the source
If blnValid Then
'Dim objRequest As HttpWebRequest = CType(WebRequest.Create("https://www.paypal.com/cgi-bin/webscr"), HttpWebRequest)
Dim objRequest As HttpWebRequest = CType(WebRequest.Create("https://www.sandbox.paypal.com/cgi-bin/webscr"), HttpWebRequest)

objRequest.Method = "POST"
objRequest.ContentLength = strPost.Length
objRequest.ContentType = "application/x-www-form-urlencoded"

objStream = New StreamWriter(objRequest.GetRequestStream())
objStream.Write(strPost)
objStream.Close()

Dim objResponse As HttpWebResponse = CType(objRequest.GetResponse(), HttpWebResponse)
Dim sr As StreamReader
sr = New StreamReader(objResponse.GetResponseStream())
Dim strResponse As String = sr.ReadToEnd()
sr.Close()

Select Case strResponse
Case "VERIFIED"
Case Else
' possible fraud
blnValid = False
End Select
End If

If blnValid Then
Dim intAdministratorRoleId As Integer
Dim strProcessorID As String
Dim objPortalInfo As PortalInfo = objPortalController.GetPortal(intPortalID)
If Not objPortalInfo Is Nothing Then
intAdministratorRoleId = objPortalInfo.AdministratorRoleId
strProcessorID = objPortalInfo.ProcessorUserId.ToLower
End If
If intRoleID = intAdministratorRoleId Then
' admin portal renewal
strProcessorID = Convert.ToString(PortalSettings.HostSettings("ProcessorUserId")).ToLower
Dim portalPrice As Single = objPortalInfo.HostFee
If (portalPrice.ToString = dblAmount.ToString) And (HttpUtility.UrlDecode(strPayPalID.ToLower) = strProcessorID) Then
objPortalController.UpdatePortalExpiry(intPortalID)
Else
Try
Dim objEventLog As New Services.Log.EventLog.EventLogController
Dim objEventLogInfo As New Services.Log.EventLog.LogInfo
objEventLogInfo.LogPortalID = intPortalID
objEventLogInfo.LogPortalName = PortalSettings.PortalName
objEventLogInfo.LogUserID = intUserID
objEventLogInfo.LogTypeKey = "POTENTIAL PAYPAL PAYMENT FRAUD"
objEventLog.AddLog(objEventLogInfo)
Catch ex As Exception

End Try
End If
Else
' user subscription
Dim objRoleInfo As RoleInfo = objRoles.GetRole(intRoleID, intPortalID)
Dim rolePrice As Double = objRoleInfo.ServiceFee
If (rolePrice.ToString = dblAmount.ToString) And (HttpUtility.UrlDecode(strPayPalID.ToLower) = strProcessorID) Then
objRoles.UpdateUserRole(intPortalID, intUserID, intRoleID, blnCancel)
Else
Try
'let's use the new logging provider.
Catch ex As Exception

End Try
End If
End If
End If
Catch exc As Exception 'Page failed to load
ProcessPageLoadException(exc)
End Try
End Sub