Final round of the 2026-08 stability audit — every remaining stack-side finding is fixed. Verified per-commit on Python 3.9 with the full test suite (4173 tests) and smoke-tested end-to-end against a physical iOS device over the pymobiledevice3 userspace tunnel (zero stranded tasks, latency unchanged).
Highlights
- Fragment reassembly is bounded and self-cleaning: the flow table refuses new flows at 64 concurrent reassemblies (the 64 KB-datagram equivalent of Linux's 4 MB
ipfrag_high_thresh) while in-progress flows still complete, and the periodic housekeeping task now reaps timed-out flows — previously the last burst of incomplete fragments was retained until the next fragment happened to arrive. - SYN floods can no longer mint unbounded embryonic sessions: a second admission gate bounds concurrent SYN_RCVD children per listening port (128, Linux
tcp_max_syn_backlogparity) — thelisten(backlog)gate only counted established-unaccepted children. stop()finishes what it starts: one worker raising during the final await no longer aborts teardown midway; every remaining subsystem is still awaited and the sysctl reset now runs in afinally, so a failed run cannot leak its overrides into the nextinit()cycle.- The IPv6 DAD claim is cancellation-safe: a claim cancelled mid-probe (stack stop during boot, a replaced DHCPv6 lease) previously leaked its registry slot and nonces, left a stale TENTATIVE state entry, and stayed joined to a solicited-node multicast group; the probe body now runs under a single-teardown
finally. accept()never returns a corpse: a child reset by its peer while queued (CLOSED, deregistered) is reaped from the accept queue instead of being handed to the application — Linuxinet_csk_acceptparity.
Deliberately left as documented behavior: the standalone daemon's fd/lifecycle hygiene (the daemon is not part of the embedded-stack surface), classical PMTU-cache aging (entries are per-genuine-peer and O(1) each), and the idle delayed-ACK re-arm (10 Hz per established session, bounded).