Interresting. I have seen the same thing with R80.40 as well. But only on traceroute from Windows (ICMP) and not from Linux (UDP).
ICMP packets with TTL=0 and TTL=1 are only seen on the client side interface with fw monitor (`fw monitor -F 0,0,0,0,1`) .
My guess is that on ICMP the TTL count is lowered by 2 instead of 1. As the steps beyond the firewall are always consistent and do show the expected hops.
As we determined that this is just an unexpected thing but otherwise harmless we did not create a ticket for this. I might do it if I can build a lab that shows the same issue. But it would most likely just be for entertainment purposes for now.
<< We make miracles happen while you wait. The impossible jobs take just a wee bit longer. >>