The FIN bit is using Sequence Number Space.
Thus a rescue retransmission at the tail end
of a session which is being closed could be
off-by-one, and lead to a invalid memory free.
Also, if the partial ACK only Acks the data,
but not the FIN bit, that could also lead to
the creation of a SACK hole with start==end.