>> Some IPSes (Intrusion Protection Systems) that perform deep-packet inspection won't pass such traffic.

We had a vendor who's product did this. Everything worked except one feature (the main feature) and a quick glance at the firewall logs showed 'malformed tcp packet' flooding the console.

It was a simple thing to disable (from just their appliance, not the whole network), but I still found it odd that they did that.