tcp: refine SYN handling in tcp_validate_incoming