6LoWPAN: The original, Contiki-based design used only a single buffer for reassemblying larger packets. This could be a problem issue for hub configurations which really need the capability concurrently reassemble multiple incoming streams concurrently. These was also a design issue in that the reassembly buffer could be corrupted by outgoing packets. The design was extended to support multiple reassembly buffers, each associated with the reassembly tag and source address. This assures that there can be be no corruption of the reassembly once it has started.

net/tcp/tcp_input.c

@@ -48,6 +48,7 @@
 
 #include <stdint.h>
 #include <string.h>
+#include <assert.h>
 #include <debug.h>
 
 #include <nuttx/net/netconfig.h>
@@ -342,9 +343,12 @@ found:
 #endif
 
           /* We must free this TCP connection structure; this connection
-           * will never be established.
+           * will never be established.  There should only be one reference
+           * on this connection when we allocated for the connection.
            */
 
+          DEBUGASSERT(conn->crefs == 1);
+          conn->crefs = 0;
           tcp_free(conn);
         }
       else