netfilter: reduce NF_VERDICT_MASK to 0xff