Originally reported via podman, in: https://github.com/containers/podman/issues/22146 For non-SYN packets TCP, passt/pasta has some quite complex to see if should add the ACK flag. In particular it sometimes won't set ACK on a flags packet that's just updating the window without advancing the ack pointer. At least some guest kernel versions reject such a packet, sending a TCP reset. Looking at the TCP RFCs, that kernel behaviour appears to be correct, see, e.g.: https://www.ietf.org/rfc/rfc9293.html#section-3.10.7.4-2.5.2.1 It's pretty hard to follow all the cases, but I think it's probably not correct for us to send any non-SYN, non-RST packet that doesn't have ACK.
Looks like we've fixed it. More details in https://github.com/containers/podman/issues/22146