diff --git a/bpf/http_sock.c b/bpf/http_sock.c
index 2eec1054f..16ecbc597 100644
--- a/bpf/http_sock.c
+++ b/bpf/http_sock.c
@@ -434,24 +434,12 @@ int BPF_KPROBE(kprobe_tcp_recvmsg, struct sock *sk, struct msghdr *msg, size_t l
     return 0;
 }
 
-SEC("kretprobe/tcp_recvmsg")
-int BPF_KRETPROBE(kretprobe_tcp_recvmsg, int copied_len) {
-    u64 id = bpf_get_current_pid_tgid();
-
-    if (!valid_pid(id)) {
-        return 0;
-    }
-
+static __always_inline int return_recvmsg(void *ctx, u64 id, int copied_len) {
     recv_args_t *args = bpf_map_lookup_elem(&active_recv_args, &id);
 
-    bpf_dbg_printk("=== tcp_recvmsg ret id=%d args=%llx copied_len %d ===", id, args, copied_len);
+    bpf_dbg_printk("=== return recvmsg id=%d args=%llx copied_len %d ===", id, args, copied_len);
 
-    if (!args) {
-        goto done;
-    }
-
-    if (copied_len <= 0) {
-        bpf_map_delete_elem(&active_recv_args, &id);
+    if (!args || (copied_len <= 0)) {
         goto done;
     }
 
@@ -502,6 +490,32 @@ int BPF_KRETPROBE(kretprobe_tcp_recvmsg, int copied_len) {
     return 0;
 }
 
+SEC("kprobe/tcp_cleanup_rbuf")
+int BPF_KPROBE(kprobe_tcp_cleanup_rbuf, struct sock *sk, int copied) {
+    u64 id = bpf_get_current_pid_tgid();
+
+    if (!valid_pid(id)) {
+        return 0;
+    }
+
+    bpf_dbg_printk("=== tcp_cleanup_rbuf id=%d copied_len %d ===", id, copied);
+
+    return return_recvmsg(ctx, id, copied);
+}
+
+SEC("kretprobe/tcp_recvmsg")
+int BPF_KRETPROBE(kretprobe_tcp_recvmsg, int copied_len) {
+    u64 id = bpf_get_current_pid_tgid();
+
+    if (!valid_pid(id)) {
+        return 0;
+    }
+
+    bpf_dbg_printk("=== kretprobe_tcp_recvmsg id=%d copied_len %d ===", id, copied_len);
+
+    return return_recvmsg(ctx, id, copied_len);
+}
+
 // Fall-back in case we don't see kretprobe on tcp_recvmsg in high network volume situations
 SEC("socket/http_filter")
 int socket__http_filter(struct __sk_buff *skb) {
diff --git a/pkg/internal/ebpf/httpfltr/bpf_arm64_bpfel.go b/pkg/internal/ebpf/httpfltr/bpf_arm64_bpfel.go
index f5c01c11a..49ccd9863 100644
--- a/pkg/internal/ebpf/httpfltr/bpf_arm64_bpfel.go
+++ b/pkg/internal/ebpf/httpfltr/bpf_arm64_bpfel.go
@@ -239,6 +239,7 @@ type bpfSpecs struct {
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpfProgramSpecs struct {
 	KprobeSysExit           *ebpf.ProgramSpec `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.ProgramSpec `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.ProgramSpec `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.ProgramSpec `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.ProgramSpec `ebpf:"kprobe_tcp_rcv_established"`
@@ -398,6 +399,7 @@ func (m *bpfMaps) Close() error {
 // It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpfPrograms struct {
 	KprobeSysExit           *ebpf.Program `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.Program `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.Program `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.Program `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.Program `ebpf:"kprobe_tcp_rcv_established"`
@@ -418,6 +420,7 @@ type bpfPrograms struct {
 func (p *bpfPrograms) Close() error {
 	return _BpfClose(
 		p.KprobeSysExit,
+		p.KprobeTcpCleanupRbuf,
 		p.KprobeTcpClose,
 		p.KprobeTcpConnect,
 		p.KprobeTcpRcvEstablished,
diff --git a/pkg/internal/ebpf/httpfltr/bpf_arm64_bpfel.o b/pkg/internal/ebpf/httpfltr/bpf_arm64_bpfel.o
index fc06ab292..9468560e8 100644
Binary files a/pkg/internal/ebpf/httpfltr/bpf_arm64_bpfel.o and b/pkg/internal/ebpf/httpfltr/bpf_arm64_bpfel.o differ
diff --git a/pkg/internal/ebpf/httpfltr/bpf_debug_arm64_bpfel.go b/pkg/internal/ebpf/httpfltr/bpf_debug_arm64_bpfel.go
index 9cd68f151..2b520ef11 100644
--- a/pkg/internal/ebpf/httpfltr/bpf_debug_arm64_bpfel.go
+++ b/pkg/internal/ebpf/httpfltr/bpf_debug_arm64_bpfel.go
@@ -239,6 +239,7 @@ type bpf_debugSpecs struct {
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpf_debugProgramSpecs struct {
 	KprobeSysExit           *ebpf.ProgramSpec `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.ProgramSpec `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.ProgramSpec `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.ProgramSpec `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.ProgramSpec `ebpf:"kprobe_tcp_rcv_established"`
@@ -401,6 +402,7 @@ func (m *bpf_debugMaps) Close() error {
 // It can be passed to loadBpf_debugObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpf_debugPrograms struct {
 	KprobeSysExit           *ebpf.Program `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.Program `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.Program `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.Program `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.Program `ebpf:"kprobe_tcp_rcv_established"`
@@ -421,6 +423,7 @@ type bpf_debugPrograms struct {
 func (p *bpf_debugPrograms) Close() error {
 	return _Bpf_debugClose(
 		p.KprobeSysExit,
+		p.KprobeTcpCleanupRbuf,
 		p.KprobeTcpClose,
 		p.KprobeTcpConnect,
 		p.KprobeTcpRcvEstablished,
diff --git a/pkg/internal/ebpf/httpfltr/bpf_debug_arm64_bpfel.o b/pkg/internal/ebpf/httpfltr/bpf_debug_arm64_bpfel.o
index 8c78c1838..a33bb717f 100644
Binary files a/pkg/internal/ebpf/httpfltr/bpf_debug_arm64_bpfel.o and b/pkg/internal/ebpf/httpfltr/bpf_debug_arm64_bpfel.o differ
diff --git a/pkg/internal/ebpf/httpfltr/bpf_debug_x86_bpfel.go b/pkg/internal/ebpf/httpfltr/bpf_debug_x86_bpfel.go
index 4cfc9aa43..ecc672e50 100644
--- a/pkg/internal/ebpf/httpfltr/bpf_debug_x86_bpfel.go
+++ b/pkg/internal/ebpf/httpfltr/bpf_debug_x86_bpfel.go
@@ -239,6 +239,7 @@ type bpf_debugSpecs struct {
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpf_debugProgramSpecs struct {
 	KprobeSysExit           *ebpf.ProgramSpec `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.ProgramSpec `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.ProgramSpec `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.ProgramSpec `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.ProgramSpec `ebpf:"kprobe_tcp_rcv_established"`
@@ -401,6 +402,7 @@ func (m *bpf_debugMaps) Close() error {
 // It can be passed to loadBpf_debugObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpf_debugPrograms struct {
 	KprobeSysExit           *ebpf.Program `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.Program `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.Program `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.Program `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.Program `ebpf:"kprobe_tcp_rcv_established"`
@@ -421,6 +423,7 @@ type bpf_debugPrograms struct {
 func (p *bpf_debugPrograms) Close() error {
 	return _Bpf_debugClose(
 		p.KprobeSysExit,
+		p.KprobeTcpCleanupRbuf,
 		p.KprobeTcpClose,
 		p.KprobeTcpConnect,
 		p.KprobeTcpRcvEstablished,
diff --git a/pkg/internal/ebpf/httpfltr/bpf_debug_x86_bpfel.o b/pkg/internal/ebpf/httpfltr/bpf_debug_x86_bpfel.o
index d6c5945a5..11b6b0b64 100644
Binary files a/pkg/internal/ebpf/httpfltr/bpf_debug_x86_bpfel.o and b/pkg/internal/ebpf/httpfltr/bpf_debug_x86_bpfel.o differ
diff --git a/pkg/internal/ebpf/httpfltr/bpf_tp_arm64_bpfel.go b/pkg/internal/ebpf/httpfltr/bpf_tp_arm64_bpfel.go
index 55cfd7e96..d0e667681 100644
--- a/pkg/internal/ebpf/httpfltr/bpf_tp_arm64_bpfel.go
+++ b/pkg/internal/ebpf/httpfltr/bpf_tp_arm64_bpfel.go
@@ -239,6 +239,7 @@ type bpf_tpSpecs struct {
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpf_tpProgramSpecs struct {
 	KprobeSysExit           *ebpf.ProgramSpec `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.ProgramSpec `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.ProgramSpec `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.ProgramSpec `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.ProgramSpec `ebpf:"kprobe_tcp_rcv_established"`
@@ -398,6 +399,7 @@ func (m *bpf_tpMaps) Close() error {
 // It can be passed to loadBpf_tpObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpf_tpPrograms struct {
 	KprobeSysExit           *ebpf.Program `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.Program `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.Program `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.Program `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.Program `ebpf:"kprobe_tcp_rcv_established"`
@@ -418,6 +420,7 @@ type bpf_tpPrograms struct {
 func (p *bpf_tpPrograms) Close() error {
 	return _Bpf_tpClose(
 		p.KprobeSysExit,
+		p.KprobeTcpCleanupRbuf,
 		p.KprobeTcpClose,
 		p.KprobeTcpConnect,
 		p.KprobeTcpRcvEstablished,
diff --git a/pkg/internal/ebpf/httpfltr/bpf_tp_arm64_bpfel.o b/pkg/internal/ebpf/httpfltr/bpf_tp_arm64_bpfel.o
index 6781e1288..373b07121 100644
Binary files a/pkg/internal/ebpf/httpfltr/bpf_tp_arm64_bpfel.o and b/pkg/internal/ebpf/httpfltr/bpf_tp_arm64_bpfel.o differ
diff --git a/pkg/internal/ebpf/httpfltr/bpf_tp_debug_arm64_bpfel.go b/pkg/internal/ebpf/httpfltr/bpf_tp_debug_arm64_bpfel.go
index 6b8a553b6..895b3fe7f 100644
--- a/pkg/internal/ebpf/httpfltr/bpf_tp_debug_arm64_bpfel.go
+++ b/pkg/internal/ebpf/httpfltr/bpf_tp_debug_arm64_bpfel.go
@@ -239,6 +239,7 @@ type bpf_tp_debugSpecs struct {
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpf_tp_debugProgramSpecs struct {
 	KprobeSysExit           *ebpf.ProgramSpec `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.ProgramSpec `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.ProgramSpec `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.ProgramSpec `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.ProgramSpec `ebpf:"kprobe_tcp_rcv_established"`
@@ -401,6 +402,7 @@ func (m *bpf_tp_debugMaps) Close() error {
 // It can be passed to loadBpf_tp_debugObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpf_tp_debugPrograms struct {
 	KprobeSysExit           *ebpf.Program `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.Program `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.Program `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.Program `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.Program `ebpf:"kprobe_tcp_rcv_established"`
@@ -421,6 +423,7 @@ type bpf_tp_debugPrograms struct {
 func (p *bpf_tp_debugPrograms) Close() error {
 	return _Bpf_tp_debugClose(
 		p.KprobeSysExit,
+		p.KprobeTcpCleanupRbuf,
 		p.KprobeTcpClose,
 		p.KprobeTcpConnect,
 		p.KprobeTcpRcvEstablished,
diff --git a/pkg/internal/ebpf/httpfltr/bpf_tp_debug_arm64_bpfel.o b/pkg/internal/ebpf/httpfltr/bpf_tp_debug_arm64_bpfel.o
index d833767f1..64c6199f9 100644
Binary files a/pkg/internal/ebpf/httpfltr/bpf_tp_debug_arm64_bpfel.o and b/pkg/internal/ebpf/httpfltr/bpf_tp_debug_arm64_bpfel.o differ
diff --git a/pkg/internal/ebpf/httpfltr/bpf_tp_debug_x86_bpfel.go b/pkg/internal/ebpf/httpfltr/bpf_tp_debug_x86_bpfel.go
index 8742da393..5b3bac597 100644
--- a/pkg/internal/ebpf/httpfltr/bpf_tp_debug_x86_bpfel.go
+++ b/pkg/internal/ebpf/httpfltr/bpf_tp_debug_x86_bpfel.go
@@ -239,6 +239,7 @@ type bpf_tp_debugSpecs struct {
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpf_tp_debugProgramSpecs struct {
 	KprobeSysExit           *ebpf.ProgramSpec `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.ProgramSpec `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.ProgramSpec `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.ProgramSpec `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.ProgramSpec `ebpf:"kprobe_tcp_rcv_established"`
@@ -401,6 +402,7 @@ func (m *bpf_tp_debugMaps) Close() error {
 // It can be passed to loadBpf_tp_debugObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpf_tp_debugPrograms struct {
 	KprobeSysExit           *ebpf.Program `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.Program `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.Program `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.Program `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.Program `ebpf:"kprobe_tcp_rcv_established"`
@@ -421,6 +423,7 @@ type bpf_tp_debugPrograms struct {
 func (p *bpf_tp_debugPrograms) Close() error {
 	return _Bpf_tp_debugClose(
 		p.KprobeSysExit,
+		p.KprobeTcpCleanupRbuf,
 		p.KprobeTcpClose,
 		p.KprobeTcpConnect,
 		p.KprobeTcpRcvEstablished,
diff --git a/pkg/internal/ebpf/httpfltr/bpf_tp_debug_x86_bpfel.o b/pkg/internal/ebpf/httpfltr/bpf_tp_debug_x86_bpfel.o
index 3ad6ded10..443e5aa70 100644
Binary files a/pkg/internal/ebpf/httpfltr/bpf_tp_debug_x86_bpfel.o and b/pkg/internal/ebpf/httpfltr/bpf_tp_debug_x86_bpfel.o differ
diff --git a/pkg/internal/ebpf/httpfltr/bpf_tp_x86_bpfel.go b/pkg/internal/ebpf/httpfltr/bpf_tp_x86_bpfel.go
index 9a96a8155..94e4244ff 100644
--- a/pkg/internal/ebpf/httpfltr/bpf_tp_x86_bpfel.go
+++ b/pkg/internal/ebpf/httpfltr/bpf_tp_x86_bpfel.go
@@ -239,6 +239,7 @@ type bpf_tpSpecs struct {
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpf_tpProgramSpecs struct {
 	KprobeSysExit           *ebpf.ProgramSpec `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.ProgramSpec `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.ProgramSpec `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.ProgramSpec `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.ProgramSpec `ebpf:"kprobe_tcp_rcv_established"`
@@ -398,6 +399,7 @@ func (m *bpf_tpMaps) Close() error {
 // It can be passed to loadBpf_tpObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpf_tpPrograms struct {
 	KprobeSysExit           *ebpf.Program `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.Program `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.Program `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.Program `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.Program `ebpf:"kprobe_tcp_rcv_established"`
@@ -418,6 +420,7 @@ type bpf_tpPrograms struct {
 func (p *bpf_tpPrograms) Close() error {
 	return _Bpf_tpClose(
 		p.KprobeSysExit,
+		p.KprobeTcpCleanupRbuf,
 		p.KprobeTcpClose,
 		p.KprobeTcpConnect,
 		p.KprobeTcpRcvEstablished,
diff --git a/pkg/internal/ebpf/httpfltr/bpf_tp_x86_bpfel.o b/pkg/internal/ebpf/httpfltr/bpf_tp_x86_bpfel.o
index 5c8cf2149..12cc8f6a7 100644
Binary files a/pkg/internal/ebpf/httpfltr/bpf_tp_x86_bpfel.o and b/pkg/internal/ebpf/httpfltr/bpf_tp_x86_bpfel.o differ
diff --git a/pkg/internal/ebpf/httpfltr/bpf_x86_bpfel.go b/pkg/internal/ebpf/httpfltr/bpf_x86_bpfel.go
index 4bff40e06..ccdb833ae 100644
--- a/pkg/internal/ebpf/httpfltr/bpf_x86_bpfel.go
+++ b/pkg/internal/ebpf/httpfltr/bpf_x86_bpfel.go
@@ -239,6 +239,7 @@ type bpfSpecs struct {
 // It can be passed ebpf.CollectionSpec.Assign.
 type bpfProgramSpecs struct {
 	KprobeSysExit           *ebpf.ProgramSpec `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.ProgramSpec `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.ProgramSpec `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.ProgramSpec `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.ProgramSpec `ebpf:"kprobe_tcp_rcv_established"`
@@ -398,6 +399,7 @@ func (m *bpfMaps) Close() error {
 // It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
 type bpfPrograms struct {
 	KprobeSysExit           *ebpf.Program `ebpf:"kprobe_sys_exit"`
+	KprobeTcpCleanupRbuf    *ebpf.Program `ebpf:"kprobe_tcp_cleanup_rbuf"`
 	KprobeTcpClose          *ebpf.Program `ebpf:"kprobe_tcp_close"`
 	KprobeTcpConnect        *ebpf.Program `ebpf:"kprobe_tcp_connect"`
 	KprobeTcpRcvEstablished *ebpf.Program `ebpf:"kprobe_tcp_rcv_established"`
@@ -418,6 +420,7 @@ type bpfPrograms struct {
 func (p *bpfPrograms) Close() error {
 	return _BpfClose(
 		p.KprobeSysExit,
+		p.KprobeTcpCleanupRbuf,
 		p.KprobeTcpClose,
 		p.KprobeTcpConnect,
 		p.KprobeTcpRcvEstablished,
diff --git a/pkg/internal/ebpf/httpfltr/bpf_x86_bpfel.o b/pkg/internal/ebpf/httpfltr/bpf_x86_bpfel.o
index f39eaddd4..795c20900 100644
Binary files a/pkg/internal/ebpf/httpfltr/bpf_x86_bpfel.o and b/pkg/internal/ebpf/httpfltr/bpf_x86_bpfel.o differ
diff --git a/pkg/internal/ebpf/httpfltr/httpfltr.go b/pkg/internal/ebpf/httpfltr/httpfltr.go
index 1f3dbccfa..4c165ddc7 100644
--- a/pkg/internal/ebpf/httpfltr/httpfltr.go
+++ b/pkg/internal/ebpf/httpfltr/httpfltr.go
@@ -228,6 +228,9 @@ func (p *Tracer) KProbes() map[string]ebpfcommon.FunctionPrograms {
 			Start:    p.bpfObjects.KprobeTcpRecvmsg,
 			End:      p.bpfObjects.KretprobeTcpRecvmsg,
 		},
+		"tcp_cleanup_rbuf": {
+			Start: p.bpfObjects.KprobeTcpCleanupRbuf, // this kprobe runs the same code as recvmsg return, we use it because kretprobes can be unreliable.
+		},
 		"sys_clone": {
 			Required: true,
 			End:      p.bpfObjects.KretprobeSysClone,
diff --git a/test/oats/kafka/docker-compose-beyla-java-kafka.yml b/test/oats/kafka/docker-compose-beyla-java-kafka.yml
index dcce9f4e5..fa7daaf12 100644
--- a/test/oats/kafka/docker-compose-beyla-java-kafka.yml
+++ b/test/oats/kafka/docker-compose-beyla-java-kafka.yml
@@ -54,6 +54,7 @@ services:
       BEYLA_METRICS_INTERVAL: "10ms"
       BEYLA_BPF_BATCH_TIMEOUT: "10ms"
       BEYLA_LOG_LEVEL: "DEBUG"
+      BEYLA_BPF_DEBUG: "true"
       OTEL_EXPORTER_OTLP_ENDPOINT: "http://collector:4318"
     depends_on:
       testserver:
diff --git a/test/oats/kafka/docker-compose-beyla-python-kafka.yml b/test/oats/kafka/docker-compose-beyla-python-kafka.yml
index 218d1ae17..986f50590 100644
--- a/test/oats/kafka/docker-compose-beyla-python-kafka.yml
+++ b/test/oats/kafka/docker-compose-beyla-python-kafka.yml
@@ -61,6 +61,7 @@ services:
       BEYLA_METRICS_INTERVAL: "10ms"
       BEYLA_BPF_BATCH_TIMEOUT: "10ms"
       BEYLA_LOG_LEVEL: "DEBUG"
+      BEYLA_BPF_DEBUG: "true"
       OTEL_EXPORTER_OTLP_ENDPOINT: "http://collector:4318"
     depends_on:
       testserver:
diff --git a/test/oats/redis/docker-compose-beyla-go-redis.yml b/test/oats/redis/docker-compose-beyla-go-redis.yml
index 48dd69239..b219976e8 100644
--- a/test/oats/redis/docker-compose-beyla-go-redis.yml
+++ b/test/oats/redis/docker-compose-beyla-go-redis.yml
@@ -37,6 +37,7 @@ services:
       BEYLA_METRICS_INTERVAL: "10ms"
       BEYLA_BPF_BATCH_TIMEOUT: "10ms"
       BEYLA_LOG_LEVEL: "DEBUG"
+      BEYLA_BPF_DEBUG: "true"
       OTEL_EXPORTER_OTLP_ENDPOINT: "http://collector:4318"
     depends_on:
       testserver:
diff --git a/test/oats/redis/docker-compose-beyla-redis.yml b/test/oats/redis/docker-compose-beyla-redis.yml
index 2dbcd9058..bcc97bd4d 100644
--- a/test/oats/redis/docker-compose-beyla-redis.yml
+++ b/test/oats/redis/docker-compose-beyla-redis.yml
@@ -37,6 +37,7 @@ services:
       BEYLA_METRICS_INTERVAL: "10ms"
       BEYLA_BPF_BATCH_TIMEOUT: "10ms"
       BEYLA_LOG_LEVEL: "DEBUG"
+      BEYLA_BPF_DEBUG: "true"
       OTEL_EXPORTER_OTLP_ENDPOINT: "http://collector:4318"
     depends_on:
       testserver:
diff --git a/test/oats/sql/docker-compose-beyla-gosqlclient-statement.yml b/test/oats/sql/docker-compose-beyla-gosqlclient-statement.yml
index 3934fed88..749d51667 100644
--- a/test/oats/sql/docker-compose-beyla-gosqlclient-statement.yml
+++ b/test/oats/sql/docker-compose-beyla-gosqlclient-statement.yml
@@ -31,6 +31,7 @@ services:
       BEYLA_METRICS_INTERVAL: "10ms"
       BEYLA_BPF_BATCH_TIMEOUT: "10ms"
       BEYLA_LOG_LEVEL: "DEBUG"
+      BEYLA_BPF_DEBUG: "true"
       OTEL_EXPORTER_OTLP_ENDPOINT: "http://collector:4318"
     depends_on:
       testserver:
diff --git a/test/oats/sql/docker-compose-beyla-gosqlclient.yml b/test/oats/sql/docker-compose-beyla-gosqlclient.yml
index 58d133a59..d731e7d76 100644
--- a/test/oats/sql/docker-compose-beyla-gosqlclient.yml
+++ b/test/oats/sql/docker-compose-beyla-gosqlclient.yml
@@ -31,6 +31,7 @@ services:
       BEYLA_METRICS_INTERVAL: "10ms"
       BEYLA_BPF_BATCH_TIMEOUT: "10ms"
       BEYLA_LOG_LEVEL: "DEBUG"
+      BEYLA_BPF_DEBUG: "true"
       OTEL_EXPORTER_OTLP_ENDPOINT: "http://collector:4318"
     depends_on:
       testserver:
diff --git a/test/oats/sql/docker-compose-beyla-sql.yml b/test/oats/sql/docker-compose-beyla-sql.yml
index 91892f563..ca6678776 100644
--- a/test/oats/sql/docker-compose-beyla-sql.yml
+++ b/test/oats/sql/docker-compose-beyla-sql.yml
@@ -42,6 +42,7 @@ services:
       BEYLA_METRICS_INTERVAL: "10ms"
       BEYLA_BPF_BATCH_TIMEOUT: "10ms"
       BEYLA_LOG_LEVEL: "DEBUG"
+      BEYLA_BPF_DEBUG: "true"
       OTEL_EXPORTER_OTLP_ENDPOINT: "http://collector:4318"
     depends_on:
       testserver: