sctp_packet_bundle_sack() modifies packet->size, but the local copy 
of this value is not updated.  The bug is that we can "put" too much
data to the skb and segfault.  Also, once DATA is in the packet, set
has_sack, so we don't inadvertantly bundle a SACK after DATA.