TCP connection failures due to dropped SYN-ACK packets

Issue

The SYN-ACK, the second packet in the TCP 3-way handshake, occasionally appears to be dropped from a Red Hat Enterprise Linux client when connecting to various other servers.

The packet:
- does not show up in tcpdump on the bond or physical interfaces
- does not show up in netstat statistics captured close to the event or /proc/net/dev
- is apparently dropped whether NIC offloading options are enabled or disabled
- is apparently dropped with bonding and firewalls enabled or disabled
- is apparently dropped with old or new firmware on the NIC
- is apparently dropped even after network cards are replaced

Network traces from a sniffer connected to a span port on the edge switch show the packets, but they don't ever seem to reach the kernel of the server.