snellv4: reuse 场景下 vectorised 写路径 panic buffer overflow: capacity N, start 0, need 23(record writer 叠层时缺 headroom 处理;snellv6 存在同类路径)

环境

• sing-snell a4e97ee(v0.0.0-20260710094516-a4e97ee24beb),经 sing-box snell 出站使用
• linux/amd64,Go 1.26
• 出站配置形如:{"type":"snell","version":4,"reuse":true,"tcp_fast_open":true,...}

现象

真实流量下每几分钟必现 panic 进程崩溃。多次崩溃 capacity 各异(78 / 791 / 1067 / 4302 / 5054 / 9986),start 恒为 0、need 恒为 23:

panic: buffer overflow: capacity 791,start 0, need 23

goroutine 2193 [running]:
github.com/sagernet/sing/common/buf.(*Buffer).ExtendHeader(0x2dcc609fea80, 0x17)
sing@v0.8.12-0.20260702081104-2ded2af32d3d/common/buf/buffer.go:116
github.com/sagernet/sing-snell/snellv4.(*writer).makeBufferRecordLocked(0x2dcc5f9a6a20, 0x2dcc609fea80, 0x0)
sing-snell@v0.0.0-20260710094516-a4e97ee24beb/snellv4/record.go:417
github.com/sagernet/sing-snell/snellv4.(*vectorisedWriter).WriteVectorised(0x2dcc5f7a9b90, {0x2dcc5ec4d688, 0x4a, 0x8f})
snellv4/record.go:657
github.com/sagernet/sing-snell/snellv4.(*vectorisedWriter).WriteVectorised(0x2dcc5f7a9c50, {0x2dcc609fe740, 0x7, 0x7})
snellv4/record.go:684
github.com/sagernet/sing/common/bufio.copyWaitVectorisedWithPool(...)
common/bufio/copy_direct.go:87
github.com/sagernet/sing/common/bufio.copyWaitWithPool(...)
common/bufio/copy_direct.go:65
github.com/sagernet/sing/common/bufio.copyExtended(...)
common/bufio/copy.go:128
github.com/sagernet/sing/common/bufio.CopyWithCounters(...)
common/bufio/copy.go:99
github.com/sagernet/sing/common/bufio.CopyWithIncreateBuffer(...)
common/bufio/copy.go:58
github.com/sagernet/sing-box/route.(*ConnectionManager).connectionCopy(...)
route/conn.go:274
created by github.com/sagernet/sing-box/route.(*ConnectionManager).NewConnection
route/conn.go:152

注意栈中有两个 snellv4.vectorisedWriter 实例::684 帧(外层)收到 pool 的 7 个 buffer、做完 records 后正在
w.upstream.WriteVectorised(flushRecords);:657 帧(内层)收到这 74 个 record,在其中一个上调 makeBufferRecordLocked 时崩溃。

任何形成两层 record writer 叠置的配置均可触发:reuse: true,或 snell 出站 detour 另一 snell 出站(实测两者均崩);reuse: false
且无叠层后不再出现。

Start with snellv4/record.go at makeBufferRecordLocked and the nested vectorisedWriter.WriteVectorised calls around lines 417, 657, and 684. Read sing/common/buf.Buffer.ExtendHeader and reproduce with reuse enabled or two layered Snell outbounds. Done means layered record writers no longer panic with a buffer overflow while reuse traffic is running.