frag-5 is not an evasion for me : We have a valid reassembly of 3 fragments, for an ICMPV6 ping then the reply Then a replay of one of the fragments (but Suricata must have forgotten it and interprets it as a new reassembly to do)
frag-13 is not an evasion for me. It is simply a big reassembly leading to a payload of 65494 bytes RFC2460 states
If the length and offset of a fragment are such that the Payload
Length of the packet reassembled from that fragment would exceed 65,535 octets, then that fragment must be discarded and an ICMP Parameter Problem, Code 0, message should be sent to the source of the fragment, pointing to the Fragment Offset field of the fragment packet.
The pcap is below that limit of 65535, which is implemented in Suricata cf IPV6_FRAG_PKT_TOO_LARGE