Process crash: nil *tlsClient in runSupervisor cleanup path (client_supervisor.go:262)

OpenVPN client endpoint crashes the whole process with a nil pointer dereference when a TLS session is closed through the supervisor's cleanup path before it was fully initialized.

Environment

• sing-box for Android (SFA), core version 1.14.0-rc.1, android/arm64, go1.26.6
• Endpoint: openvpn-client, mode tls, UDP transport, tls-auth control wrap (client direction), client certificate auth
• Config validates fine with sing-box check on 1.14.0-rc.2 (linux/amd64); the crash happens at runtime, immediately on service start
• Module version: github.com/sagernet/sing-openvpn v0.0.0-20260729104525-103eb5fe5eb6

Panic

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x74abf44d88]

goroutine 72 [running]:
github.com/sagernet/sing-openvpn.(*tlsClient).setReady(0x73d8dc5dc8?, 0xc0?)
	github.com/sagernet/sing-openvpn@v0.0.0-20260729104525-103eb5fe5eb6/client_session_tls.go:383 +0x18
github.com/sagernet/sing-openvpn.(*tlsClient).finish(0x0, {0x0, 0x0})
	github.com/sagernet/sing-openvpn@v0.0.0-20260729104525-103eb5fe5eb6/client_session_tls.go:389 +0x2c
github.com/sagernet/sing-openvpn.(*tlsClient).Close(0x0)
	github.com/sagernet/sing-openvpn@v0.0.0-20260729104525-103eb5fe5eb6/client_session_tls.go:377 +0x28
github.com/sagernet/sing-openvpn.(*Client).runSupervisor(0x73d8fd4008, {0x74ad7840a8, 0x73d903c7d0})
	github.com/sagernet/sing-openvpn@v0.0.0-20260729104525-103eb5fe5eb6/client_supervisor.go:262 +0x270
created by github.com/sagernet/sing-openvpn.(*Client).Start in goroutine 35
	github.com/sagernet/sing-openvpn@v0.0.0-20260729104525-103eb5fe5eb6/client.go:169 +0x278

Note the receivers: Close(0x0) and finish(0x0, ...) — the *tlsClient itself is nil when runSupervisor closes sessions during its cleanup path (client_supervisor.go:262). The nil entry appears to be a session slot that never completed initialization (initial handshake did not succeed against the server), and the supervisor's deferred cleanup unconditionally calls Close() on every entry.

The crash takes down the whole sing-box process (the box start goroutine 35 is then in runtime.GC() waiting for the panicking goroutine), so on Android the entire app/service dies, not just the endpoint.

Expected behavior

runSupervisor's cleanup should skip nil / not-yet-initialized session entries (or tlsClient.Close() should be nil-safe), and the endpoint should return a normal error instead of crashing the process.

Reproduction

An openvpn-client endpoint (TLS mode, client cert + tls-auth) against a server where the initial TLS/handshake phase fails quickly — the supervisor enters its cleanup path on first start and panics. Same config passes sing-box check cleanly.

Happy to test a patched sing-openvpn build on the affected server if helpful.

Start at client_supervisor.go:262 and trace the cleanup of session entries into tlsClient.Close in client_session_tls.go. Reproduce the failed initial handshake described in the issue, then verify that cleanup no longer panics and the endpoint returns a normal error when an entry was never initialized.