cfi: fix error handling for protect fn