A security analyst reviews a vendor advisory for a network appliance. The advisory states that a coding error in the appliance's session-handling routine causes the device to reload unexpectedly when it receives a specially crafted TCP packet, resulting in a denial of service. There is no data disclosure and no authentication bypass. Which vulnerability category best classifies this defect?