@kzimmermann
Forgive us if we are not too proficient in this area.

Do you have #BackgroundTor running? Eg does a command like `service tor status` show that #BgTor is running?

What does a tcpdump show? Don't show us obviously but just look for yourself. Are you seeing typically UDP 53 go into a Tor process? To be possibly converted to TCP?

Interesting! We kind of expect that our device leaked #DNSlookups but we may be wrong, and worthwhile looking into.