On vpp-dev mailing list, Matus writes:

All fragments should be dropped when max_frag is 1 and 2 non-initial fragments are received before first fragment. After a brief look into the code I see that this is not current behaviour and dropped is only second fragment so I think some improvements should be done in the future.

Matus