Looks like it's still reproducible. I just tried artificially lowering the MTU on the interface of a bastion host in a datacenter, with only one router between

Looks like it's still reproducible. I just tried artificially lowering the MTU on the interface of a bastion host in a datacenter, with only one router between it and a major IX (no middleboxes), and running apt-get against the Fastly Debian mirror: 20:55:33.402893 IP 23.141.40.254.43004 > 151.101.10.132.443: Flags [.], ack 1, win 504, options [nop,nop,TS val 4088102127 ecr 3823759533,nop,nop,sack 1 {2889:3881}], length 0 20:55:33.580057 IP 151.101.10.132.443 > 23.141.40.254.43004: Flags [.], seq 1:1445, ack 397, win 285, options [nop,nop,TS val 3823759807 ecr 4088102127], length 1444 20:55:33.580314 IP 23.141.40.254 > 151.101.10.132: ICMP 23.141.40.254 unreachable - need to frag (mtu 1420), length 556 20:55:34.155995 IP 151.101.10.132.443 > 23.141.40.254.43004: Flags [.], seq 1:1445, ack 397, win 285, options [nop,nop,TS val 3823760383 ecr 4088102127], length 1444 20:55:34.156214 IP 23.141.40.254 > 151.101.10.132: ICMP 23.141.40.254 unreachable - need to frag (mtu 1420), length 556 20:55:35.308019 IP 151.101.10.132.443 > 23.141.40.254.43004: Flags [.], seq 1:1445, ack 397, win 285, options [nop,nop,TS val 3823761535 ecr 4088102127], length 1444 20:55:35.308275 IP 23.141.40.254 > 151.101.10.132: ICMP 23.141.40.254 unreachable - need to frag (mtu 1420), length 556 20:55:37.739916 IP 151.101.10.132.443 > 23.141.40.254.43004: Flags [.], seq 1:1445, ack 397, win 285, options [nop,nop,TS val 3823763967 ecr 4088102127], length 1444 20:55:37.740191 IP 23.141.40.254 > 151.101.10.132: ICMP 23.141.40.254 unreachable - need to frag (mtu 1420), length 556 20:55:42.347790 IP 151.101.10.132.443 > 23.141.40.254.43004: Flags [.], seq 1:1445, ack 397, win 285, options [nop,nop,TS val 3823768575 ecr 4088102127], length 1444 20:55:42.348049 IP 23.141.40.254 > 151.101.10.132: ICMP 23.141.40.254 unreachable - need to frag (mtu 1420), length 556 20:55:49.539608 IP 23.141.40.254.43004 > 151.101.10.132.443: Flags [F.], seq 397, ack 1, win 504, options [nop,nop,TS val 4088118265 ecr 3823759533,nop,nop,sack 1 {2889:3881}], length 0 20:55:49.659124 IP 151.101.10.132.443 > 23.141.40.254.43004: Flags [.], ack 398, win 285, options [nop,nop,TS val 3823775887 ecr 4088118265], length 0 20:55:49.659189 IP 151.101.10.132.443 > 23.141.40.254.43004: Flags [F.], seq 3881, ack 398, win 285, options [nop,nop,TS val 3823775887 ecr 4088118265], length 0 20:55:49.715144 IP 23.141.40.254.43004 > 151.101.10.132.443: Flags [R], seq 829588935, win 0, length 0 (FWIW, this thread nudged me to email noc@fastly.com again.)