[NETFILTER]: fix conntrack refcount leak in unlink_expect()