Older iptables expanded things like 0x4000 into 0x00004000, which defeats the fallback "check" logic.