smc: Fix use-after-free in tcp_write_timer_handler().