tcp: reject out-of-order fins