Can't access vzNAT IP address without sudo on macOS (related to tmux and/or nix?)

### Description

I've been trying to track down a weird problem where I start a Lima VM with the "Docker" template, and start a Docker container that runs a web server, and try to connect to it using the vzNAT IP address assigned to the VM:

```
limactl start --name test1 template:docker --network=vzNAT --vm-type=vz
export DOCKER_HOST=unix://$HOME/.lima/test1/sock/docker.sock
docker run -d -p 8080:80 nginx:alpine
VZNAT_IP=$(limactl shell test1 ip -j route get 8.8.8.8 | jq -r '.[0].prefsrc')
```

At this point, doing `curl $VZNAT_IP:8080` works and I see the Nginx welcome page.

However, I've created a small [C program](https://gist.github.com/thomasjm/23829fa60e5f01e7080d786b7e1bf57a) which tries to create a socket and connect to the same hostname/port. But when I try to run it, I get an error:

```
> gcc test.c && ./a.out "$VZNAT_IP" 8080
host: 192.168.64.19
port: 8080
Family: 2, Protocol: 6
Socket created: 3
connect() failed: No route to host
```

But here's the crazy thing: if I use `sudo`, it works!

```
sudo ./a.out "$VZNAT_IP" 8080
host: 192.168.64.19
port: 8080
Family: 2, Protocol: 6
Socket created: 3
Connected successfully!
```

I'm finding this really baffling. Why the discrepancy between `curl` and my C program? I'd like to run `dtruss` on `curl` but it doesn't work without disabling System Integrity Protection. Even weirder, I've tried testing this with a retry every 1 second for a long time, and occasionally I've seen it suddenly manage to connect after a while?

I'm using Lima 2.0.1. I also tried Lima 1.1.1 since I remember this working better in the past, and got the same result. The main thing I can think of that has changed recently is that I upgraded to macOS Tahoe? Any help figuring this out would be much appreciated!