macOS 27 ships tcp_rbbr, a receiver-side BBR governor with no counterpart in published xnu, and makes it the default receive-background algorithm (net.inet.tcp.recv_bg_algo=2). The constants read straight out of the binary explain the packet trace exactly: initial window = rbbr_rtt_probe_rwnd_mss (4) x MSS = 5,440 bytes, rbbr_startup_gain = 200 (2x per cycle), rbbr_probe_cycle_duration = 1000 ms. So the "5,440 bytes doubling every second" I posted is tcp_rbbr stuck in startup. It gets applied to normal downloads because net_io_policy_throttle_best_effort defaults to 1 here (0 in published source), which demotes best-effort sockets to receive-background on any interface that recently sent realtime-marked traffic. Filed the disassembly and constants with the FB. Question for anyone from the networking team: is recv_bg_algo=2 the intended default for 27, and is tcp_rbbr supposed to govern foreground best-effort downloads at all?