mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-30 10:39:08 +02:00
KeysMatching returns a snapshot after releasing the refcounter lock, but reconciliation then applies that stale snapshot to WireGuard. If a concurrent decrement removes a prefix between those operations, this code re-adds a prefix whose refcount is already zero, leaving WireGuard inconsistent with the refcounter. Serialize reconciliation with allowed-IP updates, or add an equivalent atomic/compensating protocol.