Actually NSS labs, in their report brief, report a wrong cisco psirt bug ID. the bug id is for IOS based firewalls. the bug has been closed by cisco because they were not able to replicate the vulnerability. meaning, IOS firewall was not vulnerable and was able to block split handshake. the same goes for ASA based firewalls.
as for fortinet, yes they are not vulnerable IF you enable antivirus and IPS services. The NSS labs test was for Firewall vendors, not for IPS vendors. as you all know, enabling IPS services incurs extra cost, and a noticeable degradation to performance.