When ipf.c reassembles packets, it inserts the final reconstructed packet into whatever batch was the source of the last fragmented packet. Or if that batch is full, just any random batch.

This can cause a packet to appear in a batch that will have incorrect actions performed on it.

Instead, reassembled packets should be reprocessed from the start of a pipeline.