LRO with ip fragmentation

Hi,

Jean-Pascal Billaud pointed us to an interesting question:

Currently we do not check in the LRO receive path whether 
TCP packets are ip fragmented. They are aggregated in any 
case which might be wrong. The question is: Is it possible 
that we can get fragmented TCP packets without the tcp stack 
changing the MSS size? How can this be easily intentionally 
provoked for testing (only by using an extra gateway?)?

Regards,

Jan-Bernd