P7, P8, P9, P13, P14, P16, P21, P25.
For P21, also consider whether it is possible to continue using the session after the bogus TCP segment is inserted.