netfilter: fix hardcoded size assumptions