RFC3168 has a SHOULD clause to send CWR only on *new* *data* segments.
Overly conservative data receivers check this condition and ignore the
CWR flag on other packets (pure ACK and Control).
If the FreeBSD data sender sends out a pure ACK before new data, with the CWR
this can result in a race to the bottom, where the data receiver keeps
ECE latched on, and the data sender continously reducing cwnd until some
very low value.
This can be observed in particular on request/response RPC sessions, where
only minimal data is exchanged before waiting (after the TCP ACK) on the
response from the other side.