Laurent Joncheray, "A Simple Attack Against TCP",
Proceedings of the Fifth USENIX UNIX Security Symposium, page 7
(proper reading order is chronological; Morris -> Bellovin -> Joncheray)
Note that the old "hotwired" article that started this thread
slightly confuses IP spoofing and splicing.