I found that it is a bit more complex, at least in case of port 80 and simplest possible packets (like generated by 8-bit microcontrollers). Current Wireshark (4.4.2) will not change TCP to HTTP unless, at least, not just dport is 80, but also request payload ends with \r\n\r\n.