Support iptotallen=0x0000 in TSO case.

This also adds some more sanity checks to stay within the captured buffer.