syzcaller found an interesting Invariant crash

[rrs]

Summary

syzcaller came up with an interesting crash that has to do with sending
both a SYN and FIN together. Turns out there were actually two problems.

1. Not splitting the flags when you clone off a new rsm the right way (SYN should go to the left edge and FIN should go to the right)
2. a KASSERT that did not properly account for this case i.e. no mbuf/no data.

Test Plan

This pkt-drill script will currently cause a crash without the patch. With the
patch everything works as it should.

// https://syzkaller.appspot.com/bug?id=d7af235bf0fc9316b790bafe2a868fa7d69dfdc9
 0.00 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0.00 setsockopt(3, IPPROTO_TCP, TCP_FUNCTION_BLK, {function_set_name="rack",
                                                    pcbcnt=0}, 36) = 0
+0.00 sendto(3, ..., 0, MSG_EOF, ..., ...) = 0
+0.00 setsockopt(3,IPPROTO_TCP,TCP_NOOPT, [1], 4) = 0
+0.00 shutdown(3, SHUT_WR) = 0
+0.00 close(3) = 0