From what I understand (which could be totally wrong, because I've only spent a few hours on this):
-The device gives us a port for the new service (via call to SDMMD_send_service_start).
-We make a connection to the port via SDMMD__connect_to_port.
-Then we use SSL on that connection via SDMMD_lockssl_handshake.
So this is not the same as the lockdown connection despite the name of the structure used to hold the socket (SDMMD_lockdown_conn)