> How do you check that?

searched for "Great firewall latency" on my mobile. Took the first result with numbers, and saw mainland latency around 100ms higher than HK.

> The DPI works mostly in async way, mirror traffic to standalone servers to extract key data points, if found a match, send RST to drop the TCP stream and maybe further blacklist the IP indefinitely.

If it works async like you describe then it invalidates my worries about latency. But it doesn't solve the "why the hell is my SSH stream getting a RST?!" because their firewall is dropping SSH by policy or because of a false positive in the traffic.