snapshot: sagernet/gvisor v0.0.0-20260727.0-sing-box-mod.1 + SPEC 048 guard

Обновление снапшота с v0.0.0-20250811.0 на пин, которого требует
sing-box после мержа 235 коммитов (upstream d620bbbf2 "Update gvisor to
20260727.0"). Прежний снапшот был взят 2026-08-04 ровно с той версии,
на которой тогда стоял апстрим; разрыв возник 2026-08-05 вместе с его
бампом.

За год апстрим-gvisor изменил ~14 000 строк в 292 файлах. Значимое для
нас — сетевой стек: tcp/connect.go (PMTU-discovery + исправление
начального RTT/RTO: раньше задержка ACK внутри стека завышала стартовый
таймаут на несколько RTT), tcp/snd.go, tcp/rcv.go, stack/conntrack.go,
stack/packet_buffer.go. Всего 30 файлов в TCP и 37 в stack.

Баг SPEC 048 апстрим НЕ исправил — проверено по коду новой версии:
handleConnecting по-прежнему проверяет состояние endpoint'а, но не ep.h,
а performHandshake так же зануляет h и отпускает мьютекс до Close().
Поэтому guard перенесён (12 строк) вместе со своим тестом (45 строк).

Red/green проверен на новой базе: без guard'а тест падает с той же
nil-паникой, что в полевом крашдампе; с ним зелёный.

pkg/sync/gate_unsafe.go

@@ -110,8 +110,8 @@ func (g *Gate) leaveClosed() {
 	if atomic.LoadUintptr(&g.closingG) == 0 {
 		return
 	}
-	if g := atomic.SwapUintptr(&g.closingG, 0); g > preparingG {
-		goready(g, 0)
+	if cG := atomic.SwapUintptr(&g.closingG, 0); cG > preparingG {
+		goready(cG, 0)
 	}
 }
 
@@ -133,8 +133,8 @@ func (g *Gate) Close() {
 		panic("concurrent Close of sync.Gate")
 	}
 
-	if g := atomic.SwapUintptr(&g.closingG, preparingG); g != 0 {
-		panic(fmt.Sprintf("invalid sync.Gate.closingG during Close: %#x", g))
+	if cG := atomic.SwapUintptr(&g.closingG, preparingG); cG != 0 {
+		panic(fmt.Sprintf("invalid sync.Gate.closingG during Close: %#x", cG))
 	}
 	if atomic.LoadInt32(&g.userCount) == math.MinInt32 {
 		// The last call to Leave arrived while we were setting up closingG.
@@ -142,6 +142,7 @@ func (g *Gate) Close() {
 	}
 	// WaitReasonSemacquire/TraceBlockSync are consistent with WaitGroup.
 	gopark(gateCommit, gohacks.Noescape(unsafe.Pointer(&g.closingG)), WaitReasonSemacquire, TraceBlockSync, 0)
+	RaceAcquire(unsafe.Pointer(&g.closingG))
 }
 
 //go:norace

pkg/sync/runtime_constants_go_impl.go

@@ -12,14 +12,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// https://go.dev/cl/670497 (1.25) adds a new wait reason, adjusting the value of waitReasonSemacquire.
-//go:build go1.25
-
 package sync
 
 // Values for the reason argument to gopark, from Go's src/runtime/runtime2.go.
 const (
-	WaitReasonSelect      uint8 = 9  // +checkconst runtime waitReasonSelect
-	WaitReasonChanReceive uint8 = 14 // +checkconst runtime waitReasonChanReceive
-	WaitReasonSemacquire  uint8 = 19 // +checkconst runtime waitReasonSemacquire
+	WaitReasonSelect      uint8 = 18
+	WaitReasonChanReceive uint8 = 19
+	WaitReasonSemacquire  uint8 = 13
 )

pkg/sync/runtime_constants_not_go125.go

@@ -1,25 +0,0 @@
-// Copyright 2023 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// https://go.dev/cl/670497 (1.25) adds a new wait reason, adjusting the value of waitReasonSemacquire.
-//go:build !go1.25
-
-package sync
-
-// Values for the reason argument to gopark, from Go's src/runtime/runtime2.go.
-const (
-	WaitReasonSelect      uint8 = 9  // +checkconst runtime waitReasonSelect
-	WaitReasonChanReceive uint8 = 14 // +checkconst runtime waitReasonChanReceive
-	WaitReasonSemacquire  uint8 = 18 // +checkconst runtime waitReasonSemacquire
-)

pkg/sync/runtime_exectracer2_go_impl.go

@@ -16,6 +16,6 @@ package sync
 
 // TraceBlockReason constants, from Go's src/runtime/trace2runtime.go.
 const (
-	TraceBlockSelect TraceBlockReason = 3 // +checkconst runtime traceBlockSelect
-	TraceBlockSync   TraceBlockReason = 5 // +checkconst runtime traceBlockSync
+	TraceBlockSelect TraceBlockReason = 3
+	TraceBlockSync   TraceBlockReason = 5
 )

pkg/sync/runtime_spinning_asm_impl_amd64.s

@@ -12,12 +12,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// https://go.dev/cl/669235 (1.25) adds a new schedt field prior to nmspinning.
-//go:build amd64 && go1.25
+//go:build amd64
 
 #include "textflag.h"
 
-#define NMSPINNING_OFFSET 100 // +checkoffset runtime schedt.nmspinning
+#define NMSPINNING_OFFSET 116
 
 TEXT ·addrOfSpinning(SB),NOSPLIT|NOFRAME,$0-8
 	LEAQ runtime·sched(SB), AX

pkg/sync/runtime_spinning_asm_impl_arm64.s

@@ -1,4 +1,4 @@
-// Copyright 2018 The gVisor Authors.
+// Copyright 2023 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -12,15 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// https://go.dev/cl/669235 (1.25) adds a new schedt field prior to nmspinning.
-//go:build amd64 && !go1.25
+//go:build !amd64
 
-#include "textflag.h"
-
-#define NMSPINNING_OFFSET 92 // +checkoffset runtime schedt.nmspinning
-
-TEXT ·addrOfSpinning(SB),NOSPLIT|NOFRAME,$0-8
-	LEAQ runtime·sched(SB), AX
-	ADDQ $NMSPINNING_OFFSET, AX
-	MOVQ AX, ret+0(FP)
-	RET
+// This file is intentionally left blank. arm64 doesn't use
+// addrOfSpinning, but we still need an input to the nogo template rule.

pkg/sync/runtime_spinning_other.s

@@ -15,4 +15,10 @@
 //go:build !amd64
 
 // This file is intentionally left blank. Other arches don't use
-// addrOfSpinning, but we still need an input to the nogo template rule.
+// addrOfSpinning, but because this package is partially used in Netstack, we
+// should support arches that aren't amd64 or arm64. Having this file here
+// ensures that `go build` doesn't compile the package with the `-complete`
+// flag, because the package isn't made up of just '.go' files.
+// This allows Netstack to use the architecture-independent portions of this
+// package, because the architecture-dependent portions are never compiled in
+// the first place.