[ISSUE] 4.0: App allowed to connect and works fine, but log shows app as denied

[akronym0]

I allowed Firefox (ticked all three boxes for LAN, WiFi, mobile). I allowed Linux Kernel but only for LAN (ticked only one box). Firefox did not have any connection issues and opened websites just fine.

But in the log I get two "denied" entries, one for "Unknown -100" and one for "Firefox 10275" (pretty much the same time stamp +/-1s). In the Firefox log I can see the IP addresses related to the website I opened with Firefox, and pretty much the same IP addresses appear in the "Unknown -100" log.

If I completely allow the Linux Kernel (ticked all three boxes), there won't be any denied log entries for Firefox and Unknown.

Firewall Logs

10275 is Firefox

https://sharetext.io/2202fd2a

---

Tested with AFWall Donate.

[xcalc]

This is because some network functions delegated to the kernel do not work this way. Hit this with a lot of apps.
If kernel would be compromised afwall couldn't help in any way?

[akronym0]

I don't think that it the case. It works fine in AFWall +3.x. This is just a regression.