correct IPv4 option header chasing.  the old code may overrun the buffer if the option header is truncated.
correct IPv4 option header chasing.  the old code may overrun the buffer
if the option header is truncated.

i think it rather hard to attack this - he needs to know SPI,
address pair, and sequence number.

MarginC/kame,MarginC/kame,MarginC/kame,MarginC/kame,MarginC/kame,MarginC/kame,MarginC/kame