It's interesting to look at this from the perspective of HMAC codes: the host uses (several bits of) the sequence number as an authentication code over other as

It's interesting to look at this from the perspective of HMAC codes: the host uses (several bits of) the sequence number as an authentication code over other aspects of the connection. The client IP and ports are elsewhere in the packet, so the sequence number also needs to carry data for the timestamp and maximum segment size. From that security-based perspective, this bug seems to belong in a common category of data escaping the hash -- here where the (sequence number + MSS category) sum has hash collisions.