I have now tried to reproduce this bug by creating the same test setup.
Unfortunately I'm not able to reproduce it.
run out of headroom in the skb.
see how your problem can ever happen when you reject with an ICMP packet.