I'm curious if there are any examples of malformed IP or TCP headers (for example, checksums that don't match, reserved bits that aren't zero, or poor header length numbers) used by malware, or that are used in exploits.
Examples that (if they were true) would be worth mentioning:
The TCP stack of X vendor doesn't handle a header length of < 5 correctly, and crashes when it encounters it.
A botnet that uses the reserved bits of the TCP header it sends out to send messages around.