Was/is there a reason for a host to receive a packet larger than 84 byte total?
There are several layers involved here, and that's the first part of the problem. ICMP's 84 bytes for a ping message header (the payload can be larger... you can put whatever you'd like in the payload field) mean that the packets have to be received by the system on the wire protocol, reassembled into the larger packet on the IP protocol if there's fragmentation, passed on to the ICMP layer which will then check the protocol type and only after all of that can you length check it.
There are many places when writing code to allocate memory that you can make mistakes along the way. For example since you can't get more than 64k of data in a valid IPv4 packet, you might allocate a 64k memory buffer. Then when you assemble the fragments, you may be in trouble if you didn't check that the sum of the fragments is less than the allocated memory size. A specific failure made was trusting the length header of the last possible fragment as always valid within the whole reassembled packet even though the maximum offset packet wasn't allowed to be full size without breaking things.
Thus you can't immediately drop most packets without reassembly. You could add a match check on the last packet size (if offset > x and offset * 8 + len(y) > 64k
), but that would require checking extra bits in the packet which is really only suited at the firewall and host levels.