I spoke with WDS team at Microsoft and they have found a solution.
Apparently, there is an issue in WDS that causes it to use legacy NetBIOS name resolution instead of DNS to find a domain controller, and it impedes domain controller connectivity. The solution is simple - go to TCP advanced properties on WDS server, and on WINS tab disable NetBIOS over TCP/IP. This forces WDS to use the right name resolution, and everything works perfectly.
Andy
Proposed as answer by