net/xfrm: fix out-of-bounds packet access