c.NumConns was set early to len(s.clients). However, after the sort, it was possible that the actual Conns[] array be much smaller due to minoff/maxoff.
So c.NumConns is now updated only after applying the offsets.
In order to pre-allocate the Conns buffer, I no longer skip a client if tlsRequired is true and connection is gone. I will simply not update the TLSVersion and TLSCipher.