An authenticated client can crash the Hysteria server by advertising a very small QUIC max_datagram_frame_size and triggering a UDP response. The server's fragmentation code does not handle cases where the UDP message header size exceeds the maximum datagram payload size, causing a slice bounds panic and server termination. This vulnerability affects Hysteria versions prior to 2.9.2.