Thank you for your prompt response and guidance. I've filed a bug report as you suggested. The bug number is FB13764321. Appreciate your assistance!

I was able to reproduce it with a third-party VPN product too, specifically the Proxyman's iOS app. Looking at the socket flows in handleNewFlow(:) method, most of them have the value .com.nsproxy.NSProxy-iOS.PacketTunnel which I believe is Proxyman's bundle ID.