snapshot: sagernet/gvisor v0.0.0-20260727.0-sing-box-mod.1 + SPEC 048 guard

Обновление снапшота с v0.0.0-20250811.0 на пин, которого требует
sing-box после мержа 235 коммитов (upstream d620bbbf2 "Update gvisor to
20260727.0"). Прежний снапшот был взят 2026-08-04 ровно с той версии,
на которой тогда стоял апстрим; разрыв возник 2026-08-05 вместе с его
бампом.

За год апстрим-gvisor изменил ~14 000 строк в 292 файлах. Значимое для
нас — сетевой стек: tcp/connect.go (PMTU-discovery + исправление
начального RTT/RTO: раньше задержка ACK внутри стека завышала стартовый
таймаут на несколько RTT), tcp/snd.go, tcp/rcv.go, stack/conntrack.go,
stack/packet_buffer.go. Всего 30 файлов в TCP и 37 в stack.

Баг SPEC 048 апстрим НЕ исправил — проверено по коду новой версии:
handleConnecting по-прежнему проверяет состояние endpoint'а, но не ep.h,
а performHandshake так же зануляет h и отпускает мьютекс до Close().
Поэтому guard перенесён (12 строк) вместе со своим тестом (45 строк).

Red/green проверен на новой базе: без guard'а тест падает с той же
nil-паникой, что в полевом крашдампе; с ним зелёный.

pkg/rdma/snapshot.go

@@ -0,0 +1,154 @@
+// Copyright 2026 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package rdma hosts RDMA configuration and utilities shared between the
+// sentry and runsc.
+package rdma
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+)
+
+// Path is the location inside the sandbox chroot where the serialized
+// snapshot is stored. Needed to communicate this information across the boot
+// process re-exec boundary.
+const Path = "/var/lib/gvisor/rdma_sysfs.json"
+
+// PCINode is one directory in the /sys/devices/pci... hierarchy (a root
+// complex, bridge, or leaf function) with its static attribute files.
+type PCINode struct {
+	// Path is relative to /sys, e.g.
+	// "devices/pci0000:07/0000:07:01.0/0000:0c:00.0".
+	Path string `json:"path"`
+	// Attrs maps attribute file name to contents (verbatim, including any
+	// trailing newline).
+	Attrs map[string]string `json:"attrs"`
+}
+
+// Port is the per-IB-port state. Attributes split into static (immutable
+// for the sandbox lifetime, snapshotted) and live (served by reading the
+// host file at access time through a bind mount; the RoCE GID table
+// changes when netdevs move between namespaces and acquire addresses).
+type Port struct {
+	StaticAttrs map[string]string `json:"static_attrs"`
+	LiveAttrs   []string          `json:"live_attrs"`
+	// GIDNames are the entry names of the GID table (typically "0".."255").
+	// The same names index gids/<n>, gid_attrs/types/<n> and
+	// gid_attrs/ndevs/<n>, all served live.
+	GIDNames       []string `json:"gid_names"`
+	CounterNames   []string `json:"counter_names"`
+	HWCounterNames []string `json:"hw_counter_names"`
+}
+
+// NetDev is a network device associated with an RDMA device, with its
+// curated static attribute set.
+type NetDev struct {
+	Name  string            `json:"name"`
+	Attrs map[string]string `json:"attrs"`
+}
+
+// Device is one uverbs device and everything hanging off it.
+type Device struct {
+	// Uverbs is the device name, e.g. "uverbs0".
+	Uverbs string `json:"uverbs"`
+	// IBDev is the InfiniBand device name, e.g. "mlx5_0".
+	IBDev string `json:"ibdev"`
+	// LeafPCI is the PCI function directory, relative to /sys.
+	LeafPCI string `json:"leaf_pci"`
+	// Dev is the host "major:minor" of the uverbs char device.
+	Dev        string `json:"dev"`
+	ABIVersion string `json:"abi_version"`
+	// IBAttrs are the static identity attributes of
+	// /sys/class/infiniband/<ibdev>/ (node_guid, fw_ver, ...).
+	IBAttrs map[string]string `json:"ib_attrs"`
+	// Ports maps port number ("1") to its state.
+	Ports map[string]Port `json:"ports"`
+	// NetDevs are the netdevs bound to this ibdev via device/net/.
+	NetDevs []NetDev `json:"netdevs"`
+}
+
+// NUMA is the /sys/devices/system/node subtree.
+type NUMA struct {
+	// Aggregate holds the top-level range files (online, possible, ...).
+	Aggregate map[string]string `json:"aggregate"`
+}
+
+// Snapshot is the host sysfs snapshot for RDMA device topology.
+type Snapshot struct {
+	VerbsABIVersion string `json:"verbs_abi_version"`
+	// PCINodes contains every PCI directory in the closure: the leaves
+	// (NICs, GPUs) and all their ancestor bridges/roots. Sorted by Path,
+	// which places parents before children.
+	PCINodes []PCINode `json:"pci_nodes"`
+	Devices  []Device  `json:"devices"`
+	NUMA     *NUMA     `json:"numa,omitempty"`
+}
+
+// safeName matches names we are willing to reproduce inside the sandbox or
+// join into host paths. Kernel-generated sysfs names satisfy this; anything
+// else is dropped at collection time so the construction side never handles
+// a name containing a path separator or dot-dot.
+var safeName = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.:+-]*$`)
+
+// SafeName reports whether name may be used as a sysfs entry name.
+func SafeName(name string) bool {
+	return safeName.MatchString(name)
+}
+
+// bdfRE matches a PCI function directory name ("0000:0c:00.0"). The domain
+// is at least 4 hex digits: the kernel prints it with %04x, and synthetic
+// domains above 0xffff (e.g. Intel VMD) print wider.
+var bdfRE = regexp.MustCompile(`^[0-9a-f]{4,}:[0-9a-f]{2}:[0-9a-f]{2}\.[0-7]$`)
+
+// pciRootRE matches a PCI root complex directory name ("pci0000:07").
+var pciRootRE = regexp.MustCompile(`^pci[0-9a-f]{4,}:[0-9a-f]{2}$`)
+
+// IsBDF reports whether name is a PCI function directory name.
+func IsBDF(name string) bool { return bdfRE.MatchString(name) }
+
+// Save serializes the snapshot to dst, creating parent directories.
+func (s *Snapshot) Save(dst string) error {
+	dir := filepath.Dir(dst)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return fmt.Errorf("creating %q: %w", dir, err)
+	}
+	b, err := json.Marshal(s)
+	if err != nil {
+		return fmt.Errorf("marshaling RDMA sysfs snapshot: %w", err)
+	}
+	return os.WriteFile(dst, b, 0o644)
+}
+
+// Load deserializes a snapshot from src. Returns (nil, nil) if the file
+// does not exist.
+func Load(src string) (*Snapshot, error) {
+	b, err := os.ReadFile(src)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var s Snapshot
+	if err := json.Unmarshal(b, &s); err != nil {
+		return nil, fmt.Errorf("unmarshaling RDMA sysfs snapshot %q: %w", src, err)
+	}
+	return &s, nil
+}