netfilter: NF_HOOK_COND has wrong conditional