From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Wed, 17 Dec 2008 22:26:00 +1100

	if (SEQ_GT(tp->snd_up, tp->snd_nxt)) {
		u_int32_t urp = tp->snd_up - tp->snd_nxt;
		if (urp > IP_MAXPACKET)
			urp = IP_MAXPACKET;
		th->th_urp = htons((u_int16_t)urp);
		th->th_flags |= TH_URG;
	} else  

So if you think this is bad then it's been there for decades :)

No, this is a hack the BSD guys added.

This code does not appear in Richard Steven's TCP/IP Illustrated
Volume 2, as I showed in my other reply.

And bad or not, you cannot compare exposure and deployment of
the BSD stack compared to say our's or Microsoft's.  Especially
in such the unusual circumstance of URG with the URG pointer
outside of the 16-bit offset limit.

Your quick discovery of the retransmit bug nearly proves this :)