tcp: fix req->saved_syn race