Yep you are correct. I thought stunnel needed that extra layer, but it was pgbouncer escaping the trap. The patch and the top level trap works just fine.