This is more of a conceptual question. I've noticed that we sometimes drop UDP packets due to ctstate INVALID, but from my understanding that should never happen. Researching this I can't really find anything on this topic. Does ctstate INVALID only cover conntrack related problems or is it also possible to get into this state due to a broken UDP checksum or something similar?