slirp: Fill TCP/IP header template after SYN reception

This ensures we can cleanly signal the drop in case the connection timer
fires. So far we sent those frames to nowhere (target IP 0.0.0.0).

Found by the new assertion on invalid IPs in arp_table_search.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

slirp/tcp_input.c

@@ -610,6 +610,7 @@ findso:
 	    so->so_ti = ti;
 	    tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
 	    tp->t_state = TCPS_SYN_RECEIVED;
+	    tcp_template(tp);
 	  }
 	  return;