I often notice a discrepancy between /prov/net/dev's packet count and
what is dumped in tcpdump (taking tcpdump's info on number of lost
packets into account).

Therefore I wonder at what level tcpdump hooks onto the stack. Maybe
some packets are lost on the way to tcpdump?