I know that Android leaks during startup, before it has loaded iptables from a firewall. This of course is a big issue when trying to hide the true IP from an app in Orbot / Orwall.
This might sound odd, but if these leaks only happen during startup, wouldn't it be possible to just wrap the phone in some standard tinfoil if you need to reboot it (which is like once a month for a lot of people)? Would this suffice to prevent any connections until it's booted and iptables are loaded? If this actually works, it would prevent a lot of headaches trying to fix the impossible.