tcp: use correct req pointer in tcp_move_syn() calls