net/ice/base: improve flow director masking