Has anyone been able to reproduce this? Or find a report from someone who could?

The exploit depends on the user’s router having enabled a broken ALG implementation that ignores the fragment offset. I’m sure there are routers in the wild with this bug, but so far I haven’t been able to find any reports of the POC exploit working for anyone who tried it (before it was disabled).

The POC shows a message about ALG not being enabled when it fails.

Samy says he used a Netgear R7000. Would be interesting to get some POC test results from other routers.