Investigation: stack teardown with parked closing sockets (unverified)

[tinic]

INVESTIGATION, UNVERIFIED: not a confirmed defect until the reference sequence is proven.

Hypothesis: the stack can be shut down with parked closing sockets still created in NetX.

Link	Where	Status
The drain gate is sb_StackRefs <= 1; the handoff flush subtracts sb_TransientStackRefs, this gate does not	src/bsdsocket/socket.c:974; src/bsdsocket/library.c:1062-1063	read
An async AddressAllocation takes a transient hold; its release can drop the count to 0 and call bsd_netstack_shutdown_owned without draining bsd_closing_head	src/bsdsocket/addralloc.c:762; library.c:1143-1150	read
nx_ip_delete returns NX_SOCKETS_BOUND without deleting the IP thread/timers; the status is discarded and ns (containing ns_Ip) is freed	nx_ip_delete.c:107-115; src/netstack/netstack.c:213, :269-281	read
A real start/stop sequence ends on the transient release as the last reference		NOT verified

Candidate sequence: network up with the hold released; tool T starts an async DHCP AddressAllocation and closes its base; app A connects to a peer that stops answering after SYN, CloseSocket (FIN outstanding), CloseLibrary (close_all sees 2 references and skips the drain); T's job completes and the stack is torn down.

Next step: host test over bsd_close_all + bsd_stack_transient_release asserting bsd_closing_head == NULL before netstack_shutdown and that nx_ip_delete returned NX_SUCCESS.

🤖 Generated with Claude Code

[tinic]

Proven and fixed by #88 (merged). All four links held. Fix: bsd_stack_last_opener() gates both drains net of transient holds, and ami_ns_destroy keeps ns when nx_ip_delete fails instead of freeing it under a live IP thread. Tests t_transient_last_opener_drains (1 failure -> 0) and t_bound_socket_keeps_ip (1 failure -> 0).

[tinic]

Reopened: the concurrent-close leftover is real. Two closers can both skip the drain, because bsd_close_all's gate runs without sb_Lock and the close path can Wait() before the sb_StackRefs decrement. Fix on branch fix/close-all-concurrent-drain (7eca960), under review; not yet on main.

[tinic]

Leftover fixed on main (c167bb8 + bdbac79). The close gate decides, counts and detaches the handoff list under sb_Lock only; the last closer flushes and drains under the bracket after unlocking, so there is no bracket->sb_Lock cycle. It runs for every child, which covers a last closer that never made a socket. Tests on Linux: expunge, expunge_cork, handoff, accept_refused and bind_share all pass (8/8 ctest); t_tableless_last_closer failed 5 -> 0. Default bsdsocket.library +64 bytes.