Does SQL Server TDE decrypts when it enters the buffer pool and encrypts when it leaves
Yes, it is encrypted both "at rest" on disk, and also "in flight" between disk and SQL server.

https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption


  TDE performs real-time I/O encryption and decryption of the data and log files. The encryption uses a database encryption key (DEK), which is stored in the database boot record for availability during recovery. The DEK is a symmetric key secured by using a certificate stored in the master database of the server or an asymmetric key protected by an EKM module. TDE protects data "at rest", meaning the data and log files.


In other words, the data isn't decrypted until it gets to the SQL server.

Think of it this way: for it to be decrypted in-flight, the SAN itself would have to decrypt it before fulfilling the request and sending the data to SQL. And we know it isn't doing that, it is SQL that is encrypting/decrypting.