You're now the third person where I've seen the hping3 trick work, I'm pretty pleased it's with Mr Bufferbloat himself ;)
I figured this out by accident some time ago. I used fq_codel and later cake to keep people happy at a small LAN party where 10 people shared a 40Mbit DOCSIS connection. Year after year we kept renting the same vacation homes, with the same old Cisco EPC3295 cable modems. We used to bring some weird pfsense box with tons of custom game-based rules to keep latencies under control, but we just replaced that with an openwrt box running fq_codel one day, way simpler and better latencies (thank you and the other bufferbloat people!)
Suddenly one year, my openwrt/cake box was no longer able to keep the latency under control and people started complaining. I noticed that while an upload was running, the latency was fine (despite someone hogging the downstream with big downloads). As soon as the upload stopped, the big download started to cause ping spikes again.
After some testing, I was able to use the hping3 trick to send the minimum needed upstream traffic to keep pings low, LAN party saved.
Meanwhile on my home connection I used a similar DOCSIS modem. I'd always been able to just shape my connection close to the advertised rates. One day, latencies (and DSLReports bufferbloat score) got bad. Interestingly, flent RRUL results reported lower latencies during the test run than during the idle period before and after the test. Again I could use the same hping3 trick to "fix" it. I've asked the bufferbloat mailing list to see if anyone knew what was going on, but nothing came of it.
My ISP kept pushing new DOCSIS modems, so I took my chances despite it using a puma 6 chipset (TG2492LG). This one is fine without the hping trick, just like my old modem used to be.
Here's what I learned about some cable modems with my particular ISP (Ziggo, the Netherlands) in my specific region:
Cisco EPC3212 (DOCSIS 3.0 8x4), used to work fine, now gets big latency spikes regardless of the shaped rate.
Technicolor 7200 (DOCSIS 3.0 8x4), still works fine.
Arris TG2492LG (DOCSIS 3.0 24x8), shaping works just fine, latency is under control, but it has a puma 6 chip which causes latency spikes in TCP and ICMP packets. UDP does not seem to be affected.