pf has a similar problem with "reply-to". i have reported it to Daniel and problem seems to be gone in 1.380
http://www.openbsd.org/cgi-bin/cvsweb//src/sys/net/pf.c.diff?r1=1.379&r2=1.380&f=h one of my firewalls has 3.3-current with 1.379->1.380 custom patch running and has no problem. the symptoms were very similar: first SYN packet loss on TCP, than retransmit, and normal flow after.
