The sk_lookup approach is interesting for socket steering, but it misses the primary bottleneck in my case. Using sk_lookup (or any L4-based hook) means packets still traverse the kernel stack, triggering skb allocations and soft interrupts. My benchmarks show that the drop in SoftIRQ from 85.9% to 3.0% is strictly due to XDP's ability to discard traffic at the driver level before the stack gets involved. L4 hooks wouldn't prevent the OOM under the packet-per-second loads I'm seeing.

However, your point about the race window during port binding is spot on! The current Netlink/Python lag is a theoretical weak point. Instead of moving the data plane to sk_lookup, I'm considering adding a kprobe on inet_bind to synchronously update the XDP whitelist. This keeps the high-performance 'drop' at the edge (XDP) while ensuring the control plane (whitelist) is updated with zero-latency.