[darwvin-dev]

Fork-local draft for upstream #2190.

Problem

target_put() iterates target.num_destinations even when an output slot has not been completed. table_new_target() allocates the output array zero-initialized, while table_new_output() sets output.net only after crypto initialization and route setup succeed. On deletion of an incomplete target, unconditional put_net(output.net) can dereference NULL.

Change

Only call put_net() when output.net is non-NULL. Keep the existing crypto and route releases, which tolerate zero-initialized state.

Verification still required

• Audited target allocation and output completion paths on upstream-aligned master.
• Build module against affected Linux 6.12 UEK and at least one supported kernel.
• VM reproducer: create target with destinations left unfilled, then delete target; confirm no kernel Oops (also exercise output initialization failure).
• Confirm with debug symbols and disassembly/backtrace that put_net(NULL) is the reported crash site (issue author hasn't yet provided this).

Draft: plausible targeted fix, not a proven resolution of #2190 until reproduction/debugging.

---

Upstream submission notes

This is a draft, carried from contributor fork PR darwvin-dev/rtpengine#4.
Unfinished validation: Please refer to the outstanding build, runtime, regression and/or integration tests above. No claim is made that these checks passed. Review for compatibility and completeness before marking ready.
The source branch is behind current upstream master and may require reconciliation before merging.