[client] Rebind the file drop receiver when the tun is renewed

Android re-establishes the VpnService interface on every route change, which
replaces tun0 with a fresh device. The file drop listeners are bound to the
overlay address of the interface being swapped out: the IPv4 one dies with
accept4: invalid argument and never comes back, so a peer dialing the overlay
IPv4 address gets an RST. Restart the receiver once the new device is in place.

client/internal/engine.go

@@ -2452,6 +2452,8 @@ func (e *Engine) GetWgV6Addr() netip.Addr {
 	return e.wgInterface.Address().IPv6
 }
 
+// RenewTun swaps the tunnel device for the one behind fd, which the platform
+// hands over whenever it re-establishes the interface.
 func (e *Engine) RenewTun(fd int) error {
 	e.syncMsgMux.Lock()
 	wgInterface := e.wgInterface
@@ -2461,7 +2463,12 @@ func (e *Engine) RenewTun(fd int) error {
 		return fmt.Errorf("wireguard interface not initialized")
 	}
 
-	return wgInterface.RenewTun(fd)
+	if err := wgInterface.RenewTun(fd); err != nil {
+		return err
+	}
+
+	e.restartFileDrop()
+	return nil
 }
 
 // updateDNSForwarder start or stop the DNS forwarder based on the domains and the feature flag

client/internal/engine_filedrop.go

@@ -103,6 +103,22 @@ func (e *Engine) setFileDropTunnel() {
 	e.fileDrop.SetTunnel(dial, e.statusRecorder.GetLocalPeerState().FQDN)
 }
 
+// restartFileDrop rebinds the receiver after the platform replaced the tunnel
+// device. The listeners are bound to the overlay address of the interface being
+// swapped out and do not survive it: Android renews the tun on every route
+// change, which leaves the IPv4 listener dead with accept4: invalid argument.
+func (e *Engine) restartFileDrop() {
+	e.syncMsgMux.Lock()
+	defer e.syncMsgMux.Unlock()
+
+	if e.fileDrop == nil || !e.fileDropRunning || e.wgInterface == nil {
+		return
+	}
+
+	e.stopFileDrop()
+	e.startFileDrop()
+}
+
 func (e *Engine) stopFileDrop() {
 	if e.fileDrop == nil {
 		return