No solution yet, but I was able to reproduce the bug with nmap, yay!!!
#nmap -PE 192.168.101.0/24 Starting Nmap 7.12 ( https://nmap.org ) at 2016-12-01 02:50 CST sendto in send_ip_packet_sd: sendto(5, packet, 44, 0, 192.168.101.102,16) => Operation not permitted Offending packet: TCP 192.168.101.1:57520 > 192.168.101.102:21 S ttl=51 id=5430 iplen=44 seq=879361804 win=1024 <mss 1460>
Looks like -sP does more than just ping and it's not fast enough to trigger the bug. -PE is what I need to reproduce the conditions of my script.