netfilter: fix double-free and use-after free