ipsec: fix length check when adding footer+icv