I've found the solution, and it's exactly as stupid and obvious as I was expecting.
The classroom computers were deployed using Clonezilla from an image that had the VirtualBox VM pre-configured. As a result of this, every VM had the same MAC address, which probably caused a lot of ARP collisions, since all the hosts and VMs were essentially on the same broadcast domain.
The solution was to simply randomize each VM's MAC address. After that, ICMP, SSH, and HTTP worked as expected. Thanks for the suggestions, but it was caused by my own oversight in the end.
(edit) I got around to reading the comments just now, @maxy@piefed.social was totally correct.
I know this isn't "selfhosting" as most people imagine it, but it is about hosting services on own hardware, hence why I'm posting in this community.
I'm supposed to help a teacher set up a networking exercise where pairs of computers are connected directly on a crossover cable and can access services (echo, HTTP, SSH, FTP) on each other. Every computer is identical: Windows 10 host, one VirtualBox VM running Linux Mint with a bridged adapter in promiscuous mode. Each host and VM has its own static link-local IP address.
The problem is, the VMs can't talk to each other, and I don't know why.
From one VM, I can ping itself, its host, and the remote host, but not the remote VM. Each host can ping itself, the local VM, the remote host, but not the remote VM. I've tried connecting both hosts to a layer-2 switch, with the same result.
Can someone point me at the one thing that I'm obviously doing wrong?
(edit) I've also tried to set the default gateway to the host's, remote host's, and remote VM's address, but nothing changed.
Running Linux on metal isn't an option. In the past, the classroom computers used to dual boot Windows and Ubuntu, but the Windows install got so bloated (the software too, not just Windows) that it needs the full SSD.
I've re-read the docs around VirtualBox bridging, and the only thing that I think could possibly cause this (though it shouldn't since ping is a direct address to a specific IP/mac) is to enable Promiscuous mode (as cappucino mentioned).
This shouldn't fix it in my opinion, but it may, since ICMP could be considered undirected traffic (I don't, but I didn't code VirtualBox).
I've sometimes found using trace instead of ping can sometimes work where pings would be blocked, plus trace shows exactly where it dies along the path.