tls: fix ho leak on tcp connect return