Had they been running ZooKeeper on something else than Linux (I have it on FreeBSD and it rocks in this tandem) they'd spare themselves two of these bugs. This is why OS diversity is so important (and of course, they'd get a chance to serve themselves some other set of bugs instead ;).
I'm not sure if it can be said that there was a bug in IPSec/NAT-T. Caused by IPSec/NAT-T, maybe. But by documented and specified behaviour. As for aes-ni-intel (the module/implementation), I'm also not sure. Maybe that would have to be attributed to Xen - for being a bit careless. Agreedly an interesting read!
The IPSec/NAT-T behaviour was documented and specified, true. It is also wrong for the reasons pointed out in the post.
Sorry to have been unclear. I was listing the topics covered for those interested and not specifically naming sources within ZK/kernel of the bugs.