TCP uploads to Cloudflare San Jose corrupted via Comcast backbone (AS7922, 9greatoaks)

Issue

Since 2026-09-23 03:42 UTC, TCP uploads from my Xfinity connection to Cloudflare's San Jose (SJC) edge arrive corrupted. HTTPS requests to api.anthropic.com (160.79.104.10, served from Cloudflare SJC) fail with "sslv3 alert bad record mac" followed by ECONNRESET. The same requests to Cloudflare Denver (103.31.4.1) always succeed.

Request

Please have your NOC check the pe11/pe12.9greatoaks interfaces facing Cloudflare and open a ticket with Cloudflare's NOC. The pattern points to Cloudflare's SJC edge, but their NOC form doesn't confirm submissions, so an operator-to-operator ticket is the reliable path. Happy to share my account details and IP by private message.

Repro 1 (SSL errors)

head -c 262144 /dev/urandom > b
curl -sS -o /dev/null --resolve api.anthropic.com:443:160.79.104.10 -X POST https://api.anthropic.com/v1/messages --data-binary @b

-> "SSL_read: sslv3 alert bad record mac" (SJC).

With 103.31.4.1 (DEN) instead -> normal HTTP 401.

Repro 2 (plaintext payload corrupted; postman-echo.com is served by Cloudflare and echoes the body; limit ~100 KB)

head -c 73728 /dev/urandom | base64 | tr -d '\n' > payload.txt
curl -s --resolve postman-echo.com:80:108.162.192.1 -H 'Content-Type: text/plain' --data-binary @payload.txt http://postman-echo.com/post | python3 -c "import sys,json; print('OK' if json.load(sys.stdin)['data']==open('payload.txt').read() else 'CORRUPTED')"

Run 5-10 times: several print CORRUPTED via SJC (108.162.192.1), none via DEN (103.31.4.1).

Additional evidence

- Affects every Cloudflare site served from SJC (tested 7 IPs), IPv4 and IPv6. Denver: 0 failures.
- Uploads only (downloads fine); ~1% of upload packets, so failures grow with size (256 KiB+ fail ~100%).
- No packet loss or retransmissions: the corrupted packets pass TCP checksums.
- QUIC/HTTP3 to the same SJC IPs is NOT affected, so it is TCP-specific.
- Plain HTTP uploads reach the origin corrupted: in each bad packet the first 256 bytes of the frame are intact, the rest is zeros or data from a later packet.
- Path: ar01.hayward > cs01-04.9greatoaks > pe11/pe12.9greatoaks > (no reply) > Cloudflare 172.68.188.120/121.