The oplog and phylog payloads are copied several times between the WiredTiger record and the log service. Five of these copies are unnecessary.

On the primary, three:

1. Prepending the 2-byte compression header. The uncompressed path allocates a buffer of header + payload and copies both into it, so the encryptor is handed one contiguous plaintext.
2. The ciphertext out of the encryptor. The encryptor returns the ciphertext in a std::vector, and the caller copies it into a local before use.
3. Into the protobuf field. set_entry copies the ciphertext again, into the LogEntry's bytes field.

On the standby, two:

1. The no-op decompressor's buffer. After decryption, the no-op path copies the plaintext into a fresh SharedBuffer purely to get an owned BSONObj, even though the decrypted buffer is already owned and outlives the call.
2. The embedded DEK section. The decryptor copies the DEK section into a lastDEK field that nothing on the oplog path reads.

All five are copies of bytes that are only read - four are read-and-transmitted, one is not read at all.