ipsec: drop runts in esp-decrypt