tcp: Fix allocating room

For reassembly, tcpiphdr2qlink needs an additional struct qlink before the
tcpiphdr
diff --git a/src/tcp_input.c b/src/tcp_input.c
index 8b8af26..871293f 100644
--- a/src/tcp_input.c
+++ b/src/tcp_input.c
@@ -219,11 +219,11 @@
     switch (af) {
     case AF_INET:
         M_DUP_DEBUG(slirp, m, 0,
-            sizeof(struct tcpiphdr) - sizeof(struct ip) - sizeof(struct tcphdr));
+            sizeof(struct qlink) + sizeof(struct tcpiphdr) - sizeof(struct ip) - sizeof(struct tcphdr));
         break;
     case AF_INET6:
         M_DUP_DEBUG(slirp, m, 0,
-            sizeof(struct tcpiphdr) - sizeof(struct ip6) - sizeof(struct tcphdr));
+            sizeof(struct qlink) + sizeof(struct tcpiphdr) - sizeof(struct ip6) - sizeof(struct tcphdr));
         break;
     }
 
diff --git a/src/tcpip.h b/src/tcpip.h
index cb5f73f..e9c794b 100644
--- a/src/tcpip.h
+++ b/src/tcpip.h
@@ -88,8 +88,9 @@
 /* This is the difference between the size of a tcpiphdr structure, and the
  * size of actual ip+tcp headers, rounded up since we need to align data.  */
 #define TCPIPHDR_DELTA                                     \
-    (MAX(0, ((int) sizeof(struct tcpiphdr) - (int) sizeof(struct ip) - \
-             (int) sizeof(struct tcphdr) + 7) &                  \
+    (MAX(0, ((int) sizeof(struct qlink) + \
+             (int) sizeof(struct tcpiphdr) - (int) sizeof(struct ip) - \
+             (int) sizeof(struct tcphdr) + 7) & \
                 ~7))
 
 /*