We were masking the fragment offset bits incorrectly in the IPv4 header sent out with fragments. This worked up to ~32KB but after that, things would get very confused. :^)