Re: NPF: broken checksums

[Robert Elz <kre%munnari.OZ.AU@localhost>]

    Date:        Tue, 3 Apr 2018 07:48:19 +0200
    From:        Maxime Villard <max%m00nbsd.net@localhost>
    Message-ID:  <11cba205-ba75-757a-689a-db9897d9835d%m00nbsd.net@localhost>

  |  However, if the packet
  | contains another TCPOPT_MAXSEG option,

I assume you mean here in the same TCP header, rather than in some
included packet (ie: a tunnel or similar).

In that case, I think what happens to the packet is whatever we please,
and forcing the second (and any later) MSS options to be the same as
the first is entirely reasonable.   As would be just about anything else,
including simply sending RST.

kre