[Mad_Dud]

Does anybody have PoC on this one?

[packetlss]

It's said to be a 32 bit refcounter bug, making it near impossible to predict the triggering packet over WAN.

[marshray]

If so, would require hundreds of GB of UDP packets.

But you may not need to predict which one is the one that wraps the counter. It may be that all your packets could be the same.