shutdown: закрывать shared sqlite (topo_sqlite_db) в самом конце utun_instance_destroy (UAF при teardown)

src/routing_layer/topo_group.c

@@ -502,8 +502,9 @@ void topo_groups_destroy(struct UTUN_INSTANCE* instance) {
     memory_pool_destroy(g->v6_subnet_pool);
     DEBUG_INFO(DEBUG_CATEGORY_SYS, "[TOPO_DESTROY] 7 pools destroyed");
 
-    if (instance->topo_sqlite_db) { sqlite3_close(instance->topo_sqlite_db); instance->topo_sqlite_db = NULL; }
-    DEBUG_INFO(DEBUG_CATEGORY_SYS, "[TOPO_DESTROY] 8 sqlite closed");
+    /* Shared SQLite DB закрывается в utun_instance_destroy() в самом конце —
+     * chat/media/db_sync ещё используют его во время teardown. */
+    DEBUG_INFO(DEBUG_CATEGORY_SYS, "[TOPO_DESTROY] 8 sqlite deferred (закрывается в utun_instance_destroy)");
 
     u_free(g); instance->topo_groups = NULL; instance->conn_mgr = NULL;
     DEBUG_INFO(DEBUG_CATEGORY_SYS, "[TOPO_DESTROY] 9 done");

src/utun_instance.c

@@ -614,6 +614,14 @@ void utun_instance_destroy(struct UTUN_INSTANCE *instance) {
         instance->nodeinfo_cbks = r->next; u_free(r);
     }
 
+    // Shared SQLite DB закрываем в самом конце: routing/chat/media/db_sync
+    // используют его во время всего teardown (см. topo_groups_destroy).
+    if (instance->topo_sqlite_db) {
+        sqlite3_close(instance->topo_sqlite_db);
+        instance->topo_sqlite_db = NULL;
+        DEBUG_INFO(DEBUG_CATEGORY_SYS, "[INSTANCE_DESTROY] shared sqlite closed");
+    }
+
     u_free(instance);
     DEBUG_INFO(DEBUG_CATEGORY_SYS, "[INSTANCE_DESTROY] Instance destroyed completely");
 }