netfilter: ipt_REJECT: avoid touching dst ref