Linux socket is not using the src-ip from the bind address

I have a single Linux machine with 3 interfaces, eth0, host1, and loopback. And I have an application that sends out packets at the loopback and routed out to host1. To achieve this, my application creates a client socket that binds to an address “5.6.7.8” which is a loopback interface. (The bind was successful and verified by “getsockname” api). Here goes the loopback cfg:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 5.6.7.8/32 scope global lo
       valid_lft forever preferred_lft forever

And the application sends a packet out to destination IP (1.2.3.4) which will be routed through host1.

# ip route
default via 16.254.1.1 dev eth0
1.2.3.4 dev host1 scope link
16.254.1.1 dev eth0 scope link

# ip route get 1.2.3.4
1.2.3.4 dev host1 src 20.0.1.1 uid 0
    cache

# ifconfig host1
host1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 20.0.1.1  netmask 255.255.255.0  broadcast 0.0.0.0
    ether da:3f:23:ff:f2:bc  txqueuelen 1000  (Ethernet)
    RX packets 105  bytes 8858 (8.6 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 6017  bytes 280258 (273.6 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

So I’d expect packets from my application will use the source IP of 5.6.7.8, but when I capture the packet through tcpdump, it’s source IP is actually using 20.0.1.1 which is from host1. I checked the iptables and no NAT rules installed. Does anyone know what could cause this behavior?