gopacket reads the second IPv4 layer always and this causes a few interesting cases
Case 1: The packet is fine, so gopacket reports the inner packet's source IP.
Case 2: The packet is malformed, so gopacket just barrels on through and reads the packet anyways as if it were correct (which creates some rather "interesting" results)
gopacket's decode function is not obvious and causes issues and may need some major rework.
There are two approaches, fix this or throw out every packet that has protocol type 4.