Automatic merge from submit-queue (batch tested with PRs 38194, 37594, 38123, 37831, 37084)

Better compat with very old iptables (e.g. CentOS 6)

Fixes reported issue with CentOS6 iptables 1.4.7 (ancient)

Older iptables expanded things like 0x4000 into 0x00004000, which defeats the
fallback "check" logic.

Fixes #37416