I traced that same pattern multiple times which led us to diagnose the likely injected FIN/ACK as the culprit