WireGuard's socket.c calls udp_tunnel_xmit with the DF bit set to 0, which means if the underlying endpoint's path has an MTU that is too small, the UDP packet will simply be fragmented, not dropped.