time: catch xtime_nsec underflows and fix them