I can one up that. I had corrupt HTTP payloads with what looked like boot loader data being inserted ! I tracked it back to VMWare host with a physical NIC driver that was reading past the buffer, and picking up the bootloader from memory. Inside the guest, wire shark was happy, but upstream at the LB it was receiving the nasty payload.