Minor: forwaring packets to kernel does not imply drop