IPReassembler bug fix

A painstaking bug hunt discovered this.  If we were unlucky enough, an instruction near there would get into an spurious page fault loop until the packet freed above was re-allocated by a driver.