wireguard: run feature after gso