netfilter: xtables: obtain random bytes earlier, in checkentry