Is it possible that collision occurs when malicious user spoofs his IP to imitate legitimate user and sends IP with same src/dest/"Identification Field" values in IP's header thus causing reassembly of corrupted IP datagram? How to prevent it?
If an attacker is able to read IP packets because nothing prevents him to do so in the network (e.g. IPsec) then yes, he can send crafted packets with the same ID field than legitimate ones. IP does not protect this value from being read.
The attacker needs to predict what the Identification field will be in the packet if he has not seen a fragment yet or sniff it and sends a packet/fragment fast enough to be taken into account.
There is a race between the packet/fragment sent in the same time by the legitimate user and the one sent by an attacker unless the attacker is in a man-in-the-middle position and can stop and replace legitimate packets.
How fragments are reassembled are dependant of operating systems, one may prefer the first fragment that has been received with a certain offset, another might prefer the last one (first option is more common in reverse overlap cases, second is more common in forward overlap cases). A very good paper has been published years ago about it.
It is hard to detect and prevent, the same mecanisms than the ones for preventing IP spoofing could be used:
- Layer 2 protections (802.1x...)
- Check for IP origin (filter packets from outside your network claiming to be inside)
But nothing in IP itself can prevent it.