diff --git a/bpf_progs/netd.c b/bpf_progs/netd.c
index 74b09e7..9f5c743 100644
--- a/bpf_progs/netd.c
+++ b/bpf_progs/netd.c
@@ -413,7 +413,8 @@
     // Always allow and never count clat traffic. Only the IPv4 traffic on the stacked
     // interface is accounted for and subject to usage restrictions.
     // CLAT IPv6 TX sockets are *always* tagged with CLAT uid, see tagSocketAsClat()
-    if (uid == AID_CLAT) return PASS;
+    // CLAT daemon receives via an untagged AF_PACKET socket.
+    if (egress && uid == AID_CLAT) return PASS;
 
     int match = bpf_owner_match(skb, sock_uid, egress, kver);