tcp: fix double-counted receiver RTT when leaving receiver fast path