Yes - happened to me once. I could reproduce it consistently until I turned tcpdump on , at which point it would go away. I resorted to ebpf as well.