Fragment overlaps definitely occur too, though the ones I've tracked down
(not many) have been due to holding fragments for a long time and the IP
ID counter rolling over (producing a new set of fragments with the same ID).
I don't know how often they occur within the fragment reassembly time window.