Yes that's the most common. Assuming good hardware and application software the one I see second most often is when a UDP packet which is more than one IP fragm

Yes that's the most common. Assuming good hardware and application software the one I see second most often is when a UDP packet which is more than one IP fragment goes-out but an ARP has to happen only one of the IP fragments is then sent so the other end can't combine them. This is an old BSD network stack bug that lives on in hardware and software out in the wild to this day.