ICMP-error NAT for other protocol corrupts inner source (copy-paste bug)

Summary

pf_test_state_icmp default inner-proto case: guard tests pd2.dst(:5732) but calls pf_change_icmp(pd2.src,...)(:5734) should be pd2.dst. ICMPv6 inner case(:5635-5643) correct. Copy-paste from source branch. Inner dest untranslated + inner source overwritten. Remote: ICMP error embedding non-TCP/UDP/ICMP packet on NAT state.