IPsec: modify post-decrypt buf len calculation