R002 from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md §3.1:
netstack/src/filter/conntrack.rs captured '(is_orig, entry_key)' in
an if/else, but the 'if let' arm early-returned on line 293, so
is_orig was always true when execution reached the second 'if let'
on line 298. The reply-direction state machine (advance_entry_state
with is_orig=false, lines 213-242) was effectively unreachable for
already-established flows.
Fix: flatten the conditional. The reply-side 'if let' now early-
returns on match; the fall-through uses the original-direction key
directly (no entry_key clone needed since reply_key was already
consumed by the first if-let). The 'is_orig' variable is gone;
the orig-side path now calls advance_entry_state with is_orig=true
explicitly.
Reply-direction advances now actually happen for already-
established connections, restoring correct TCP/UDP conntrack
state-machine behaviour.
Red Bear OS
946d28d8ad