Because the TCP checksum was incorrect, the packet would never reach a higher level such as TLS. TCP or ICMP would be the only options; maybe IPsec.