Hmm, from that command output, I'm still not quite sure. The most significant difference I can see from casual inspection is:
Sony: 19000: from all fwmark 0xcd/0x1ffff iif lo lookup 1026 21000: from all fwmark 0xce/0x1ffff lookup 1026 Galaxy: 19000: from all fwmark 0x2ad/0x1ffff iif lo lookup 1017 21000: from all fwmark 0x2ab/0xffff lookup 1017 Is the galaxy missing a leading 0x1 in the mask of that second rule there? What do you get on each when you run `ip route get 10.220.0.4`? Same thing or is it different? I also noticed that on the Galaxy, there's a direct route to some telco server -- `90.132.128.59 via 10.220.0.1 dev wlan0 table 99 proto static`. I didn't see this direct route on the Sony. I doubt it's related to the above, but I've also never seen this before and wonder if it's some VoLTE/VoWIFI hand-over trick in recent Android networking stacks.
