Thanks to Russell King for some excellent debugging.

Conntrack defragments locally generated packets before they hit
ip_fragment.  In this case the fragments have skb->dst set, and
that needs to be released.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>