fix: resolve race conditions and crash on VPN disconnect

- Reversed stop order: cancel Go context first, wait for client to drain, then stop tun2socks engines
- Introduced clientDone channel in Go to synchronize client shutdown with engine teardown
- Handled JNI CancellationException and 'context canceled' logs safely in Kotlin service
- Prevented double-close native SIGSEGV crash using duplicated TUN fd

Author: Hidden-Node

android/app/src/main/java/com/masterdns/vpn/service/MasterDnsVpnService.kt

@@ -222,11 +222,18 @@ class MasterDnsVpnService : VpnService() {
                             configFile.absolutePath,
                             logFile.absolutePath
                         )
+                    } catch (_: CancellationException) {
+                        // Normal shutdown — coroutine was cancelled during disconnect.
+                        VpnManager.appendLog("Go core stopped (coroutine cancelled)")
                     } catch (e: Exception) {
-                        Log.e(TAG, "Go core error", e)
-                        VpnManager.appendLog("Go core error: ${e.message}")
-                        withContext(Dispatchers.Main) {
-                            VpnManager.setError("Go core error: ${e.message}")
+                        // Only log real errors, not context cancellation from Go.
+                        val msg = e.message ?: ""
+                        if (!msg.contains("context canceled", ignoreCase = true)) {
+                            Log.e(TAG, "Go core error", e)
+                            VpnManager.appendLog("Go core error: $msg")
+                            runCatching {
+                                VpnManager.setError("Go core error: $msg")
+                            }
                         }
                     }
                 }

mobile/mobile.go

@@ -13,6 +13,7 @@ import (
 	"path/filepath"
 	"sync"
 	"syscall"
+	"time"
 
 	"masterdnsvpn-go/internal/client"
 	"masterdnsvpn-go/internal/config"
@@ -35,6 +36,7 @@ var (
 	logCb            LogCallback
 	tunRunning       bool
 	tunBridgeRunning bool
+	clientDone       chan struct{} // closed when app.Run(ctx) returns
 )
 
 // Bandwidth holds upload and download counters for gomobile bindings.
@@ -70,19 +72,26 @@ func StartClient(configPath string, logPath string) error {
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
 
 	mu.Lock()
 	vpnClient = app
 	cancelFunc = cancel
+	clientDone = done
 	running = true
 	mu.Unlock()
 
 	runErr := app.Run(ctx)
 
+	// Signal that the client has fully stopped BEFORE clearing state.
+	// StopClient waits on this channel to know it's safe to tear down tun2socks.
+	close(done)
+
 	mu.Lock()
 	running = false
 	vpnClient = nil
 	cancelFunc = nil
+	clientDone = nil
 	mu.Unlock()
 
 	return runErr
@@ -139,18 +148,36 @@ func StopTun() {
 }
 
 // StopClient gracefully stops the running client.
+// Order: cancel Go context first (stops traffic), wait for client to drain,
+// THEN stop tun2socks (no more goroutines writing to the engine).
 func StopClient() {
-	StopTun()
-	StopTunBridge()
-
+	// 1. Cancel context — tells app.Run(ctx) to shut down.
 	mu.Lock()
-	defer mu.Unlock()
-	if cancelFunc != nil {
-		cancelFunc()
-		cancelFunc = nil
+	cancel := cancelFunc
+	done := clientDone
+	cancelFunc = nil
+	mu.Unlock()
+
+	if cancel != nil {
+		cancel()
+	}
+
+	// 2. Wait for the Go client to fully stop (with timeout).
+	//    This ensures no goroutine is writing to the tun2socks engine
+	//    when we tear it down in step 3.
+	if done != nil {
+		select {
+		case <-done:
+		case <-time.After(3 * time.Second):
+		}
 	}
+
+	// 3. NOW it's safe to stop tun2socks — no traffic flowing.
+	StopTun()
+	StopTunBridge()
 }
 
+
 // IsRunning returns true if the client is currently running.
 func IsRunning() bool {
 	mu.Lock()