netfilter: nf_nat: fix out-of-bounds access in address selection