ng_ppp_frag_checkstale sequence tracking diverges after gaps: stale-packet delivery suppressed

Summary

ng_ppp_frag_checkstale(:1384-1395): running seq counter initialized once from head frag then only advanced by MP_NEXT_RECV_SEQ, never re-synced when first frag encountered. After sequence gap: seq diverges from real fragment seqs -> else-if qent->seq!=seq(:1388) spuriously clears beg=NULL -> complete packet never recognized by stale-delivery fallback. Primary delivery path ng_ppp_check_packet(:1170-1197) correct (uses per-fragment seq). Malicious PPP peer creates seq gaps -> sustained reassembly stalls / packet loss. No memory corruption.