gnrc_ipv6: correctly reset from temporary variable

While `tmp` in the loop for write-protection for the check-sum
calculation is used to check the return value of
`gnrc_pktbuf_start_write()`, it was never overwriting `payload` causing
the original snip to be used in the following iteration `prev` when
duplicated, and destroying the sanity of `ipv6`.

sys/net/gnrc/network_layer/ipv6/gnrc_ipv6.c

@@ -437,6 +437,7 @@ static int _fill_ipv6_hdr(gnrc_netif_t *netif, gnrc_pktsnip_t *ipv6)
              * original packet by other subscriber */
             return -ENOMEM;
         }
+        payload = tmp;
         prev->next = payload;
         prev = payload;
     } while (_is_ipv6_hdr(payload));