I think the func code [L178-L239](https://github.com/google/netstack/blob/26bc1beb19b61a85b86be893b58e91b96e5a029d/tcpip/transport/tcp/connect.go#L178-L239) has logical problems, look at the Basic 3-Way Handshake for Connection Synchronization:  TCP B can split `<CTL=SYN,ACK>` into `<CTL=ACK>` and `<CTL=SYN>`, then send them successively, so [L194](https://github.com/google/netstack/blob/26bc1beb19b61a85b86be893b58e91b96e5a029d/tcpip/transport/tcp/connect.go#L194) will block the TCP B's `<CTL=ACK>`. If you want TCP A only accept `<CTL=SYN,ACK>` from TCP B, [L224-L236 ](https://github.com/google/netstack/blob/26bc1beb19b61a85b86be893b58e91b96e5a029d/tcpip/transport/tcp/connect.go#L224-L236) is unnecessary.
I think the func code L178-L239 has logical problems, look at the Basic 3-Way Handshake for Connection Synchronization:
TCP B can split
<CTL=SYN,ACK>into<CTL=ACK>and<CTL=SYN>, then send them successively, so L194 will block the TCP B's<CTL=ACK>.If you want TCP A only accept
<CTL=SYN,ACK>from TCP B, L224-L236 is unnecessary.