Simulation aborts in assert in /network/model/buffer.h at line 680.
The reason for this behaviour seems to be the lacking ipv4 fragmentation support in ipv4-flow-classifier.cc. When a fragmented ip datagram arrives, transport layer header is read in Ipv4FlowClassifier::Classify without any checks about the ip fragmentation. Thus the remaining fragmented data is considered to be a transport layer header, which causes the failing assert if there are less bytes in the fragment than e.g. UDP header size.