ndr: mark invalid pull ndr_flags as unlikely