tcp: must unclone packets before mangling them