Recv-Q on a listening socket counts connections that finished the handshake but the application has not accepted yet. When it equals Send-Q the accept queue is full and the kernel still answers SYN, so a port check passes while the service never replies.
ss -lnt 'sport = :443' netstat -s | grep -i 'listen queue'