firewall: fix potential NULL pointer access