"... to trigger the vulnerable code path, an application on the target must be bound to a raw socket."

Isn't that unlikely unless the victim runs a network capture tool like Wireshark or similar?