If not fixed, the assertion "unsent_oversize mismatch (pcb vs. last_unsent)" can fire in tcp_out.c.

diff --git a/src/core/tcp_out.c b/src/core/tcp_out.c
index b9fc339..524416e 100644
--- a/src/core/tcp_out.c
+++ b/src/core/tcp_out.c
@@ -1261,11 +1261,21 @@ tcp_rexmit_rto(struct tcp_pcb *pcb)
   for (seg = pcb->unacked; seg->next != NULL; seg = seg->next);
   /* concatenate unsent queue after unacked queue */
   seg->next = pcb->unsent;
+#if TCP_OVERSIZE
+  /* if last unsent changed, we need to update unsent_oversize */
+  if (pcb->unsent == NULL) {
+#if TCP_OVERSIZE_DBGCHECK
+    pcb->unsent_oversize = seg->oversize_left;
+#else
+    /* Punt on figuring this out since we always use TCP_OVERSIZE_DBGCHECK */
+#error "Without tcp_seg.oversize_left, how can unsent_oversize be updated?"
+#endif /* TCP_OVERSIZE_DBGCHECK */
+  }
+#endif /* TCP_OVERSIZE */
   /* unsent queue is the concatenated queue (of unacked, unsent) */
   pcb->unsent = pcb->unacked;
   /* unacked queue is now empty */
   pcb->unacked = NULL;
-  /* last unsent hasn't changed, no need to reset unsent_oversize */
 
   /* increment number of retransmissions */
   ++pcb->nrtx;