diff --git a/staticlibs/framework/com/android/net/module/util/ConnectivitySettingsUtils.java b/staticlibs/framework/com/android/net/module/util/ConnectivitySettingsUtils.java
index b7eb70b..f4856b3 100644
--- a/staticlibs/framework/com/android/net/module/util/ConnectivitySettingsUtils.java
+++ b/staticlibs/framework/com/android/net/module/util/ConnectivitySettingsUtils.java
@@ -60,6 +60,10 @@
     }
 
     private static int getPrivateDnsModeAsInt(String mode) {
+        // If both PRIVATE_DNS_MODE and PRIVATE_DNS_DEFAULT_MODE are not set, choose
+        // PRIVATE_DNS_MODE_OPPORTUNISTIC as default mode.
+        if (TextUtils.isEmpty(mode))
+            return PRIVATE_DNS_MODE_OPPORTUNISTIC;
         switch (mode) {
             case "off":
                 return PRIVATE_DNS_MODE_OFF;
@@ -68,7 +72,10 @@
             case "opportunistic":
                 return PRIVATE_DNS_MODE_OPPORTUNISTIC;
             default:
-                throw new IllegalArgumentException("Invalid private dns mode: " + mode);
+                // b/260211513: adb shell settings put global private_dns_mode foo
+                // can result in arbitrary strings - treat any unknown value as empty string.
+                // throw new IllegalArgumentException("Invalid private dns mode: " + mode);
+                return PRIVATE_DNS_MODE_OPPORTUNISTIC;
         }
     }
 
@@ -82,9 +89,6 @@
         final ContentResolver cr = context.getContentResolver();
         String mode = Settings.Global.getString(cr, PRIVATE_DNS_MODE);
         if (TextUtils.isEmpty(mode)) mode = Settings.Global.getString(cr, PRIVATE_DNS_DEFAULT_MODE);
-        // If both PRIVATE_DNS_MODE and PRIVATE_DNS_DEFAULT_MODE are not set, choose
-        // PRIVATE_DNS_MODE_OPPORTUNISTIC as default mode.
-        if (TextUtils.isEmpty(mode)) return PRIVATE_DNS_MODE_OPPORTUNISTIC;
         return getPrivateDnsModeAsInt(mode);
     }
 
diff --git a/staticlibs/native/bpf_headers/include/bpf/KernelVersion.h b/staticlibs/native/bpf_headers/include/bpf/KernelVersion.h
index e0e53a9..29a36e6 100644
--- a/staticlibs/native/bpf_headers/include/bpf/KernelVersion.h
+++ b/staticlibs/native/bpf_headers/include/bpf/KernelVersion.h
@@ -16,8 +16,7 @@
 
 #pragma once
 
-#include <stdlib.h>
-#include <string.h>
+#include <stdio.h>
 #include <sys/utsname.h>
 
 namespace android {
diff --git a/staticlibs/native/tcutils/Android.bp b/staticlibs/native/tcutils/Android.bp
index 88a2683..84a32ed 100644
--- a/staticlibs/native/tcutils/Android.bp
+++ b/staticlibs/native/tcutils/Android.bp
@@ -20,7 +20,7 @@
     name: "libtcutils",
     srcs: ["tcutils.cpp"],
     export_include_dirs: ["include"],
-    header_libs: ["bpf_syscall_wrappers"],
+    header_libs: ["bpf_headers"],
     shared_libs: [
         "liblog",
     ],
@@ -53,7 +53,7 @@
         "-Werror",
         "-Wno-error=unused-variable",
     ],
-    header_libs: ["bpf_syscall_wrappers"],
+    header_libs: ["bpf_headers"],
     static_libs: [
         "libgmock",
         "libtcutils",
diff --git a/staticlibs/native/tcutils/kernelversion.h b/staticlibs/native/tcutils/kernelversion.h
deleted file mode 100644
index 9aab31d..0000000
--- a/staticlibs/native/tcutils/kernelversion.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// -----------------------------------------------------------------------------
-// TODO - This should be replaced with BpfUtils in bpf_headers.
-// Currently, bpf_headers contains a bunch requirements it doesn't actually provide, such as a
-// non-ndk liblog version, and some version of libbase. libtcutils does not have access to either of
-// these, so I think this will have to wait until we figure out a way around this.
-//
-// In the mean time copying verbatim from:
-//   frameworks/libs/net/common/native/bpf_headers
-
-#pragma once
-
-#include <stdio.h>
-#include <sys/utsname.h>
-
-#define KVER(a, b, c) (((a) << 24) + ((b) << 16) + (c))
-
-namespace android {
-
-static inline unsigned uncachedKernelVersion() {
-  struct utsname buf;
-  if (uname(&buf)) return 0;
-
-  unsigned kver_major = 0;
-  unsigned kver_minor = 0;
-  unsigned kver_sub = 0;
-  (void)sscanf(buf.release, "%u.%u.%u", &kver_major, &kver_minor, &kver_sub);
-  return KVER(kver_major, kver_minor, kver_sub);
-}
-
-static unsigned kernelVersion() {
-  static unsigned kver = uncachedKernelVersion();
-  return kver;
-}
-
-static inline bool isAtLeastKernelVersion(unsigned major, unsigned minor,
-                                          unsigned sub) {
-  return kernelVersion() >= KVER(major, minor, sub);
-}
-
-} // namespace android
diff --git a/staticlibs/native/tcutils/tcutils.cpp b/staticlibs/native/tcutils/tcutils.cpp
index 4101885..37a7ec8 100644
--- a/staticlibs/native/tcutils/tcutils.cpp
+++ b/staticlibs/native/tcutils/tcutils.cpp
@@ -19,7 +19,7 @@
 #include "tcutils/tcutils.h"
 
 #include "logging.h"
-#include "kernelversion.h"
+#include "bpf/KernelVersion.h"
 #include "scopeguard.h"
 
 #include <arpa/inet.h>
@@ -504,7 +504,7 @@
     // shipped with Android S, so (for safety) let's limit ourselves to
     // >5.10, ie. 5.11+ as a guarantee we're on Android T+ and thus no
     // longer need this non-upstream compatibility logic
-    static bool is_pre_5_11_kernel = !isAtLeastKernelVersion(5, 11, 0);
+    static bool is_pre_5_11_kernel = !bpf::isAtLeastKernelVersion(5, 11, 0);
     if (is_pre_5_11_kernel)
       return false;
   }
diff --git a/staticlibs/native/tcutils/tests/tcutils_test.cpp b/staticlibs/native/tcutils/tests/tcutils_test.cpp
index 3a89696..53835d7 100644
--- a/staticlibs/native/tcutils/tests/tcutils_test.cpp
+++ b/staticlibs/native/tcutils/tests/tcutils_test.cpp
@@ -18,7 +18,7 @@
 
 #include <gtest/gtest.h>
 
-#include "kernelversion.h"
+#include "bpf/KernelVersion.h"
 #include <tcutils/tcutils.h>
 
 #include <BpfSyscallWrappers.h>
@@ -82,7 +82,7 @@
   // TODO: this should likely be in the tethering module, where using netd.h would be ok
   static constexpr char bpfProgPath[] =
       "/sys/fs/bpf/tethering/prog_offload_schedcls_tether_downstream6_ether";
-  const int errNOENT = isAtLeastKernelVersion(4, 19, 0) ? ENOENT : EINVAL;
+  const int errNOENT = bpf::isAtLeastKernelVersion(4, 19, 0) ? ENOENT : EINVAL;
 
   // static test values
   static constexpr bool ingress = true;
@@ -118,7 +118,7 @@
   ASSERT_LE(3, fd);
   close(fd);
 
-  const int errNOENT = isAtLeastKernelVersion(4, 19, 0) ? ENOENT : EINVAL;
+  const int errNOENT = bpf::isAtLeastKernelVersion(4, 19, 0) ? ENOENT : EINVAL;
 
   // static test values
   static constexpr unsigned rateInBytesPerSec =