Since 5.9.6, the number of half-open SAs includes queued initial IKE
messages. So that number could be higher than the number of managed
SAs, which causes an underflow in the output.
Fixes: b866ee88bf ("ike: Track unprocessed initial IKE messages like half-open IKE_SAs")