tcp: fix more NULL deref after prequeue changes