This bug causes buffer overrun.
LWIP_NAT_TMR_INTERVAL_SEC defined in ipv4_nat.h is in miliseconds, but ip_nat_check_timeout() thinks it's in seconds. With this bug, all nat entries will expire immediately when ip_nat_check_timeout() is called. Note sys_timeout() is in miliseconds.