Turns out GnuTLS has a buffer for the record layer attached to the session. After the first GET in the main process, it looks like this:
--8<---------------cut here---------------start------------->8--- (gdb) p session->internals.record_buffer $9 = {head = 0x7f7370, tail = 0x7f7370, length = 1, byte_length = 16219} (gdb) p *session->internals.record_buffer->head $10 = {next = 0x0, prev = 0x0, mark = 165, msg = { data = 0x7f73c0 "HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 10 Mar 2021 21:23:44 GMT\r\nContent-Type: text/html\r\nContent-Length: 16397\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\n\r\n<!DOCTYPE html><html lang=\"en\"><hea"..., size = 16384}, maximum_size = 18751, uhead_mark = 0, type = GNUTLS_APPLICATION_DATA, record_sequence = 1, epoch = 0, htype = 72, handshake_sequence = 0} (gdb) p *(&session->internals.record_buffer->head.msg.data[165]) $11 = 60 '<' (gdb) p (&session->internals.record_buffer->head.msg.data[165]) $12 = (unsigned char *) 0x7f7465 "<!DOCTYPE html><html lang=\"en\"><head><title>GNU's advanced distro and transactional package manager — GNU Guix</title><meta charset=\"UTF-8\" /><meta name=\"keywords\" content=\"GNU, Linux, Unix, Free s"... --8<---------------cut here---------------end--------------->8--- IOW, the main process hasn’t consumed the body of the HTTP response. This is because with ‘filtered-port’, the input port is dumped from a child process, not from the calling process. To be continued… Ludo’.