ipsec: rewind missing from dual loop