flow_classify: fix out-of-bounds access