ipsec: fix trailing data overflow