Just because its not configured or not configurable doesn't mean its not actually doing it (it may be a bug).

I have an Ethernet over FrameRelay Radio PTMP system that after a few months of uptime inserts the UDP payload of customer A into the TCP payload of customer B (customer B using this TCP session to transfer files to a AS400 that doesn't check TCP checksums and therefor the UDP payload of customer A makes it into the application of customer B). The only fix here is to reload the whole system.