expectation refcount is set to 1 in ip_conntrack_expect_alloc, and 
incremented again in ip_conntrack_expect_related. So once the 
ip_conntrack_expect_free is called, the expectation is never released.