netfilter: prefer extension check to pointer check