35c038b0a4be ("netfilter: nf_nat: mask out non-verdict bits when checking return value")