- Read skc_rcv_saddr/skc_daddr as [u8; 4] instead of u32 to preserve network byte order — fixes reversed IP addresses in eBPF events - Clear is_partial flag on bootstrapped connections when first eBPF event arrives, so they merge instead of appearing as duplicates Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>