NAT Deadlock Resolution
OpenBSD Reality

PF Randomises source ports
per destination { ip, port } tuple

TCP ISN modulation

Attack not possible