3 ms·

Fair concern, but eBPF here only tags local sockets fwmark all untrusted network traffic and Tor crypto are parsed safely in userspace via Arti!