diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/SaCloseReason.kt b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/SaCloseReason.kt
index eeae75fc5..93749ed10 100644
--- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/SaCloseReason.kt
+++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/SaCloseReason.kt
@@ -17,7 +17,9 @@ package org.strongswan.android.logic
 /** Why an established IKE SA went down; for the diagnostic log only (plan 8.1). */
 enum class SaClose(val label: String, val drop: Boolean)
 {
-	USER("user", false),
+	/* any deliberate disconnect: the user, a scenario, a pause or the trusted-network
+	 * park (the line logged just before says which) */
+	USER("disconnect requested", false),
 	REAUTH("reauth", false),
 	RETRANSMIT_AFTER_NETWORK_CHANGE("retransmit-timeout after network change", true),
 	RETRANSMIT_TIMEOUT("retransmit-timeout", true),
diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_dns_proxy.c b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_dns_proxy.c
index e5ddeb14f..df2a033d8 100644
--- a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_dns_proxy.c
+++ b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_dns_proxy.c
@@ -22,6 +22,7 @@
 #include <string.h>
 
 #include "android_dns_proxy.h"
+#include "../charonservice.h"
 
 #include <daemon.h>
 #include <threading/rwlock.h>
@@ -137,7 +138,12 @@ static int open_socket(int family)
 		DBG1(DBG_NET, "could not open proxy socket: %s", strerror(errno));
 		return -1;
 	}
-	if (!charon->kernel->bypass_socket(charon->kernel, skt, family))
+	/* not through the kernel interface: that also adds the socket to the list
+	 * that is protected again on every network change, from which nothing is
+	 * ever removed.  These sockets live for SOCKET_TIMEOUT seconds, so the
+	 * list only collected closed descriptors (43 failed protect() calls on
+	 * one roam after an hour, more with every query) */
+	if (!charonservice->bypass_socket(charonservice, skt, FALSE))
 	{
 		DBG1(DBG_NET, "installing bypass policy for proxy socket failed");
 		close(skt);