Comment # 6 on bug 1212839 from Richard Palethorpe

Yes, this could be caused by the ipt_state module not being loaded. Except that
the kernel should load the module and retry.

        match = xt_find_match(nfproto, name, revision);
        if (IS_ERR(match)) {
                request_module("%st_%s", xt_prefix[nfproto], name);
                match = xt_find_match(nfproto, name, revision);
        }

I think xt_find_match is the only function that can return ENOENT before the
checks are done which should cause EINVAL.