nat: fix dual-loop tcp checksum botch