nat: fix per-vrf session bookkeeping