nftables accepts established flows but drops the related ICMP fragmentation signal so PMTU discovery never converges

Normal traffic starts, then large payloads stall because the firewall policy forgot a control message that is not part of the main flow tuple.