Hello Rob:

This is an intriguing problem.  Thus far, using your configuration we have not been able to produce a mismatch. We are winding up work on our next releases, 4.3.6/4.1-ESV-R15, which are due out 7/31/17, so our resources are somewhat limited.

Could you supply us with pcaps of the traffic that causes the mismatch?

Regards,

Thomas Markwalder
ISC Software Engineering