tcp: fix use after free in tcp_xmit_retransmit_queue()