A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3 5.4 and 6.0 and OpenBSD when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used allows remote attackers to cause a denial of service (crash) via crafted packets that cause a packet fragment to be inserted twice.