Fix the handling of fragmented unordered messages when using DATA chunks

and FORWARD-TSN.

This bug was reported in https://github.com/sctplab/usrsctp/issues/286
for the userland stack.

This is joint work with rrs@.

MFC after:		1 week

sys/netinet/sctp_indata.c

@@ -947,6 +947,15 @@ sctp_inject_old_unordered_data(struct sctp_tcb *stcb,
 		SCTPDBG(SCTP_DEBUG_XXX,
 		    "chunk is a first fsn: %u becomes fsn_included\n",
 		    chk->rec.data.fsn);
+		at = TAILQ_FIRST(&control->reasm);
+		if (at && SCTP_TSN_GT(chk->rec.data.fsn, at->rec.data.fsn)) {
+			/*
+			 * The first chunk in the reassembly is a smaller
+			 * TSN than this one, even though this has a first,
+			 * it must be from a subsequent msg.
+			 */
+			goto place_chunk;
+		}
 		if (control->first_frag_seen) {
 			/*
 			 * In old un-ordered we can reassembly on one