Thanks, I misunderstood the socat documentation and thought that I would (should) be able to specify which local address socat should listen on. When I removed the network on the listen side, it worked much better. Now my command looks like this:
The parameters at the beginning configure socat‘s logging and set the ID to use when logging (I actually have three instances of socat for three different systems, so I wanted to be able to differentiate between the log messages.) The max-children=1 setting tells socat to only allow ONE connection at a time while the fork allows socat to start listening for a new connection when the current connection terminates (correctly — I’ve fond VNC clients don’t always send a FIN to close the TCP connection when they’re closed, which messes socat up.)
Thanks again, sorry to be a bother and I hope this help someone else in the future!