The manual byte assembly (sa_buf[2]<<8 | sa_buf[3]) already produces a host-byte-order port value; __builtin_bswap16 was swapping it again, causing SSL events to use wrong source ports and preventing TLS/HTTP session correlation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>