Problem

The shared audit test helper assumes that a proxied connection always has different remote and directRemote source ports. This is not guaranteed: the client-to-proxy and proxy-to-server TCP connections have different destination ports, so they may legally use the same ephemeral source port.

This causes intermittent failures in audit_remote_local_intermediate.js even when the audit fields are correct. See BF-45214.

Evidence

* BFG-3468973: July 27, 2026, mongodb-mongo-master @ 70265a8648337733e93d5896ccdc04afd5e73dd7, audit on Amazon Linux 2023 ARM64 with replicated size/count feature flags.
* BFG-3463946: July 25, 2026, mongodb-mongo-master @ 6ba92dd1ca833f6c6b338aa04c201a527680ffd7, audit on Amazon Linux 2023 ARM64 with extensions. Same assertion, with both ports equal to 46780.
* The July 27 failure occurs during authentication in the sharded-cluster PROXY protocol v2 scenario at test line 140. Expected local, remote, and intermediates checks pass; only the source-port inequality fails.

Observed audit fields:

local:        {ip: "127.0.0.1", port: 20763}
intermediates: \[{ip: "127.0.0.1", port: 20762}\]
remote:       {ip: "127.0.0.1", port: 35342}
directRemote: {ip: "127.0.0.1", port: 35342}

[Failing test log|https://parsley.corp.mongodb.com/test/mongodb_mongo_master_enterprise_amazon_linux2023_arm64_all_feature_flags_with_replicated_size_and_count_audit_70265a8648337733e93d5896ccdc04afd5e73dd7_26_07_26_22_41_03/0/dc0403a7ed58205c064dc30fa0365c51?shareLine=0]

Root Cause

In src/mongo/db/modules/enterprise/jstests/audit/lib/audit_remote_local_intermediate_lib.js, assertAuditAuth() sets directRemoteDivergenceExpected = !!proxy_server. assertDirectRemoteEndpoint() then executes assert.neq(directEndpoint.port, remoteEndpoint.port) at line 276.

The following distinct TCP four-tuples are legal:

shell 127.0.0.1:35342 \-> proxy  127.0.0.1:20762
proxy 127.0.0.1:35342 \-> mongos 127.0.0.1:20763

The faulty assertion was introduced by SERVER-130194, commit ff515d4d9d390ae48f04cd675f53561d9e01656e (July 9, 2026). The observed failures strongly support legal ephemeral-port reuse; the proxy outgoing socket port was not independently captured at the failure instant.

Scope and Acceptance Criteria

* Remove the assumption that using a proxy guarantees unequal remote and directRemote ports in the shared Mongo/OCSF audit helper.
* Preserve field presence, shape, loopback-IP, expected remote/local/intermediates checks, and equality checks for non-proxied connections.
* If validating the proxied direct endpoint, compare against the actual outgoing proxy socket endpoint rather than asserting inequality with the client endpoint. Account for multiple active connections if using ProxyProtocolServer.getServerPort().
* Cover equal client/proxy source ports deterministically, while retaining coverage that directRemote/direct_endpoint records the literal peer rather than merely copying the advertised endpoint.
* Validate both Mongo and OCSF audit tests across standalone, replica-set, and sharded proxy scenarios.

Validation

Analysis based on Evergreen failure logs and source inspection. No local builds or tests were run.