Just tested on Debian 12:
# hping3 <host> -c 1 --syn --tcp-mss 100
This triggers the discussed rule (output from 'nft monitor trace'):
...
trace id 98d76ca4 netdev filter ingress rule meta protocol . tcp option maxseg size { ip . 0-535, ip6 . 0-1219 } tcp flags syn log prefix "TCP MSS: " counter packets 0 bytes 0 drop (verdict drop)
hping3 also doesn't work with IPv6 though.
