DNS Protection becomes permanently inactive after PacketTunnelProvider restart; startup repeatedly stops during ActivityStatistics initialization

### Please answer the following questions for yourself before submitting an issue

- [x] Filters were updated before reproducing an issue
- [x] I checked the [knowledge base](https://adguard.com/kb/) and found no answer
- [x] I checked to make sure that this issue has not already been filed

Related reports are noted below; a shared root cause is not established.

### AdGuard version

4.5.21 (1052), exported as `4.5.21.1052`. AdGuard DNS library: 2.8.45.

### Environment

- OS: iOS 26.6 (as reported in all four archives).
- Device: iPhone; the exports do not identify the specific model.
- AdGuard Pro features enabled.
- AdGuard VPN is not installed or running, according to the exports.

### Ad Blocking

AdGuard Base filter, AdGuard Mobile Ads filter

### Privacy

AdGuard Tracking Protection filter, AdGuard Mail Tracking Protection filter

### Social

AdGuard Social Media filter

### Annoyances

AdGuard Annoyances filter, AdGuard Cookie Notices filter, AdGuard Popups filter, AdGuard Mobile App Banners filter, AdGuard Other Annoyances filter, AdGuard Widgets filter

### Security

Phishing URL Blocklist

### Other

No additional enabled Safari filters listed in the exported state.

### Language-specific

No enabled language-specific filters listed in the exported state.

### Advanced protection for Safari

- [x] yes, I do

The export reports `Complex protection enabled: true` and advanced rules.

### Which DNS server do you use?

AdGuard DNS

### DNS protocol

DNS-over-HTTPS

### Custom DNS

Not applicable; predefined AdGuard DNS, using `https://dns.adguard-dns.com/dns-query`.

### DNS filtering

- [x] yes, I do

### Custom DNS filter

No additional custom DNS filter is listed in the exported state. The enabled AdGuard DNS filter is `https://filters.adtidy.org/dns/filter_1_ios.txt`.

### DNS implementation

AdGuard

### Tunnel mode

Split-Tunnel

### Low-level settings

- Custom bootstrap servers: none listed.
- Custom fallback servers: none listed.
- Restart when network changes: enabled.
- Filter mobile data: enabled.
- Filter Wi-Fi data: enabled.
- Blocking mode and other low-level settings: not established by the exported state.

### Issue Details

DNS Protection's local VPN repeatedly becomes inactive and fails to finish starting. This has occurred across multiple incidents; restarting the iPhone consistently restores operation.

Observed reproduction sequence (intermittent, not a guaranteed on-demand reproduction):

1. Use DNS Protection with the configuration above over time. The failure logs show approximately 110,000 ActivityStatistics records.
2. In one fully captured transition, let the background filter update complete. On 2026/08/17 at 08:58:46, the application logs `filtersUpdateFinished`, successful filter loading/saving, and `updateSettings called waiting for 1 second before restart`. At 08:58:47 it logs `restartTunnel called`; the working tunnel is stopped at 08:58:48 and a replacement is requested.
3. The replacement tunnel repeatedly starts, reaches ActivityStatistics database initialization/compaction/repopulation, and disappears from the log before normal DNS packet handling resumes. New PacketTunnelProvider instances repeat this sequence.
4. Restart the iPhone. DNS Protection initializes successfully and normal DNS traffic returns.

The later incident also shows a startup failure loop already running before the main application is opened. That archive contains background updates too, so it does not prove that no background restart occurred. The common reported problem is the repeated startup failure, rather than a claim that filter updates are the sole cause.

### Expected Behavior

DNS Protection should resume normal DNS handling after a tunnel restart. A startup problem should recover without requiring an iPhone reboot.

### Actual Behavior

AdGuard repeatedly reports `VPN is inactive`, while new PacketTunnelProvider instances start without reaching operational DNS traffic.

The recurring sequence, condensed from the logs, is:

```text
PacketTunnelProvider startTunnel
Successfully set settings
DnsProxy - start
ActivityStatistics - init start
connected to activity_statistics.db
ActivityStatistics - compressTable
ActivityStatistics - reset successfully finished
ActivityStatistics - adding approximately 110,000 records
[no subsequent normal DNS packet handling from this startup;
another PacketTunnelProvider starts and repeats the sequence]
```

Representative record counts across failures:

| Archive | ActivityStatistics records |
| --- | ---: |
| AdGuard_logs.zip | 109444 |
| AdGuard_logs 3.zip | 109753 |
| AdGuard_logs 4.zip | 109866 |

For example, the third archive records `adding 109753 records` at 09:35:33.233, another `startTunnel` at 09:35:39.122, `adding 109753 records` at 09:35:46.831, and another `startTunnel` at 09:35:52.748, all on 2026/08/17.

The underlying network continues to be reported as available (`en0`, IPv4/IPv6, DNS availability, good link quality, and a gateway). Before failure, DoH requests to AdGuard DNS receive successful `NOERROR` responses. This makes an upstream outage less likely.

The post-reboot archive shows normal `AGDnsProxy handleIPv4Packet` traffic and successful DNS responses again around 04:12–04:13 on 2026/08/17.

### Screenshots

Not supplied; diagnostic logs capture the startup sequence and recovery.

### Additional Information

**Observed failure point versus root cause:** ActivityStatistics is the consistent last logged startup operation, but these application logs do not establish why the extension terminates. Memory pressure, startup limits, or another cause remain hypotheses. No iOS jetsam/crash report confirming the termination reason is included in these exports. Increasing counts are consistent with accumulated activity data, rather than a fixed internal constant.

**Related reports:**

- #1935 (closed) documented memory-limit termination during `ActivityStatistics.compressTable`, associated with bulk insertion. This is particularly relevant historical context, but does not prove that the current failures have the same cause.
- #2456 (open) reports an infinite reconnect loop after leaving Airplane mode. This report provides a different observed trigger and the repeated ActivityStatistics startup signature; whether they share a cause is unknown.

**Diagnostic archives:** timestamps below are as recorded in the logs; their timezone is not asserted.

1. AdGuard_logs.zip — original failure; ends during repeated initialization on August 17 around 04:09, with 109444 records.
2. AdGuard_logs2.zip — export immediately after restarting the iPhone; shows recovery and normal DNS traffic around 04:12–04:13 on August 17.
3. AdGuard_logs3.zip — healthy DNS → background filter update → tunnel restart around 08:58 on August 17 → repeated failed startup with 109753 records, continuing through 09:35.
4. AdGuard_logs4.zip — later recurrence on August 19; startup loop already active before the main app is opened, ending at 08:15 with 109866 records.