From be791ee7b27cd1ecaa344d9cc21a303be61c5c36 Mon Sep 17 00:00:00 2001
From: Evgeny <me@jeka.su>
Date: Sun, 31 May 2026 01:05:12 +0300
Subject: [PATCH] drain transport_to_uip at FIN to prevent data delivery after
 close (eliminates RST storm)

---
 src/tcp_proxy.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/tcp_proxy.c b/src/tcp_proxy.c
index c88e4841..1d35b0ef 100644
--- a/src/tcp_proxy.c
+++ b/src/tcp_proxy.c
@@ -276,6 +276,9 @@ static err_t proxy_recv_cb(void *arg, struct tcp_pcb *pcb, struct pbuf *p, err_t
         DEBUG_INFO(DEBUG_CATEGORY_SOCKET, "PROXY FIN stream=%016llx tun=1 active=%d", (unsigned long long)(pc->remote_stream_id ? pc->remote_stream_id : 0), pc->active);
         { uint16_t wnd_gap = TCP_WND_MAX(pcb) - pcb->rcv_wnd;
           if (wnd_gap > 0) tcp_recved(pcb, wnd_gap); }
+        if (pc->transport_to_uip) {
+            struct ll_entry* e; while ((e = queue_data_get(pc->transport_to_uip))) { queue_dgram_free(e); queue_entry_free(e); }
+        }
         pc->closing_tun = 1;
         return LERR_OK;
     }