decrypt in place                move buffer ref.
+----------------+ (no copy)        +------------+ (no copy)         +------------+
| receive buffer +--=-------------->| plain text +--=--------------->| disk cache |
+----------------+                  | buffer     |                   +------+-----+
        ^                           +------------+                          |
        | read() on socket                                 write() to file  | 
        | (copy)                                           (copy)           | 
---=----|---------------------------------=---------------------------------|--=----
        |                        kernel space                               |
        |                                                                   v
+-------+--------+                                               +-------------------+
| socket kernel  |                                               | kernel page cache |
| buffer         |                                               |                   |
+----------------+                                               +-------------------+