tcp: don't read out-of-bounds opsize