xfrm: properly handle invalid states as an error