netfilter: don't drop packets with offsets pointing outside the packet