Do modern routers drop malformed IP packets

Solution 1:

A packet with a forged source address isn't malformed; it's well formed syntactically. So no router would drop it as "malformed".

If the forged source address violates ingress or egress filtering rules - for example, if you send a packet with a 192.168.x.y source address to the outside interface of a NAT device which uses 192.168.x on the inside - then the router will drop it.

If the forged source address is just some random device on the Internet, then the router will process it normally. If "process it normally" means sending some data larger than the request packet back out to the forged source, then that's what's called an amplification attack.

Solution 2:

If an IP datagram is malformed (chechksum doesn't match, ...) the router should just drop it. It's job is to find where to forward incoming datagrams that make sense.

But most routers (given that electronics is much, much more capable/performant today) take on more tasks. Like not forwarding datagrams with source addresses that come from the "wrong" interface --like a fake address in the destination network-- or that are clearly doctored --source address is a broadcast address-- up to filtering by IP source/destination, TCP/UDP source/destination port or other firewall functions including NAT/PAT. Doing even the most basic of this does avoid useless traffic and helps with security. For example, some TCP/IP stacks misbehave or even crash handling datagrams or segments with illegal/unusual flag combinations, reacting to faked source addresses can have undesirable consecuences (like the (in)famous Mitnick attack).

One quite annoying "feature" of many commercial products is that they silently drop IP datagrams or TCP segments that use reserved flags (usually set to zero, intended for future extensions). When ECN (Explicit Congestion Notification) started to be used in earnest by Linux' TCP, many connections just failed: Some "helpful" router en route noticed the "illegal" flag set and silently dropped the traffic.