net/dccp: fix use after free in tw_timer_handler()