KeysMatching returns a snapshot after releasing the refcounter lock,
but reconciliation then applies that stale snapshot to WireGuard.
If a concurrent decrement removes a prefix between those operations,
this code re-adds a prefix whose refcount is already zero, leaving WireGuard
inconsistent with the refcounter. Serialize reconciliation with allowed-IP updates,
or add an equivalent atomic/compensating protocol.
059d6939f5