tested this CVE with 32-bit on 4.9.3, and it seems to be fixed

[tcpdump] / tests / rx_ubik-oobr.out

IP truncated-ip - 2598 bytes missing! 222.241.104.198.3503 > 131.63.241.146.7002:  rx data pt ubik call disk-lock tid 50266112.32382 file 2122216448 pos 545160708 length 1087685554 [|ubik] (2632)