ipsec: fix sa counters in esp-decrypt