Yes, if the server uses kTLS, it'll be easy for such a probe to get the plaintext, because the syscalls themselves will contain the plaintext. It won't have to

Yes, if the server uses kTLS, it'll be easy for such a probe to get the plaintext, because the syscalls themselves will contain the plaintext. It won't have to do TLS library-specific shenanigans to hook userspace functions or extract the key material like this submission does.