diff --git a/services/core/java/com/android/server/NetworkManagementService.java b/services/core/java/com/android/server/NetworkManagementService.java
index de9c7308afae..44b54ba8741e 100644
--- a/services/core/java/com/android/server/NetworkManagementService.java
+++ b/services/core/java/com/android/server/NetworkManagementService.java
@@ -282,8 +282,10 @@ private static class RestrictIf {
 
     @GuardedBy("mQuotaLock")
     private RestrictIf[] mRestrictIf = {
-            new RestrictIf(RESTRICT_USECASE_DATA, NetworkCapabilities.TRANSPORT_CELLULAR),
+            // Ordered by match preference (in the event we get a callback with
+            // multiple transports).
             new RestrictIf(RESTRICT_USECASE_VPN, NetworkCapabilities.TRANSPORT_VPN),
+            new RestrictIf(RESTRICT_USECASE_DATA, NetworkCapabilities.TRANSPORT_CELLULAR),
             new RestrictIf(RESTRICT_USECASE_WLAN, NetworkCapabilities.TRANSPORT_WIFI),
     };
 
@@ -360,6 +362,7 @@ public void onLinkPropertiesChanged(Network network, LinkProperties linkProperti
                 for (RestrictIf restrictIf : mRestrictIf) {
                     if (nc.hasTransport(restrictIf.transport)) {
                         matchedRestrictIf = restrictIf;
+                        break;
                     }
                 }
                 if (matchedRestrictIf == null) {
@@ -1559,6 +1562,7 @@ private void updateAppOnInterfaceCallback(RestrictIf restrictIf, String newIface
                         continue;
                     }
                     setAppOnInterfaceLocked(restrictIf.useCase, restrictIf.ifName, uid, false);
+                    restrictIf.active.setValueAt(i, false);
                     // Use pending list to queue re-add.
                     // (Prefer keeping existing pending status if it exists.)
                     if (restrictIf.pending.indexOfKey(uid) < 0) {