Suricata

Given a subsequent fragment that starts before an original fragment, and overlaps the beginning of the original fragment, Suricata has been preferring the data from the original fragment.

However, per the Novak-Sturges paper, the original fragment data should only be preferred if it has an offset <= to the new fragment.

Fix is to use the data from the new fragment if it has an offset less than the offset of the original fragment.

This is covered in the test bsd/peose/test9.