From d307a227d4c0baff71946071b280cda0a72b64ab Mon Sep 17 00:00:00 2001
From: James Stringer <38541878+jamesstringer90@users.noreply.github.com>
Date: Tue, 15 Sep 2026 20:17:41 -0400
Subject: [PATCH] Prevent shared-network races during simultaneous VM starts

Serialize Windows shared-network lookup and creation so concurrently started VMs reuse the same network.
---
 src/backend_win/hcn_network.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/src/backend_win/hcn_network.c b/src/backend_win/hcn_network.c
index d4bee9d..59acb10 100644
--- a/src/backend_win/hcn_network.c
+++ b/src/backend_win/hcn_network.c
@@ -27,6 +27,7 @@ typedef HRESULT (WINAPI *PFN_HcnOpenNetwork)(
 /* ---- Loaded function pointers ---- */
 
 static HMODULE g_hcn_dll = NULL;
+static SRWLOCK g_network_lock = SRWLOCK_INIT;
 
 static PFN_HcnCreateNetwork    pfnCreateNet;
 static PFN_HcnCreateEndpoint   pfnCreateEp;
@@ -306,7 +307,9 @@ static void pick_nat_base_once(void)
 
 const char *hcn_nat_subnet_base(void)
 {
+    AcquireSRWLockExclusive(&g_network_lock);
     pick_nat_base_once();
+    ReleaseSRWLockExclusive(&g_network_lock);
     return g_nat_base;
 }
 
@@ -322,10 +325,13 @@ HRESULT hcn_create_nat_network(GUID *network_id)
 
     *network_id = APPSANDBOX_NAT_GUID;
 
+    AcquireSRWLockExclusive(&g_network_lock);
     /* Reuse the existing AppSandbox NAT network if it's already up -
        multiple VMs share one network, each with its own endpoint. */
-    if (hcn_network_exists(&APPSANDBOX_NAT_GUID))
+    if (hcn_network_exists(&APPSANDBOX_NAT_GUID)) {
+        ReleaseSRWLockExclusive(&g_network_lock);
         return S_OK;
+    }
 
     pick_nat_base_once();
 
@@ -353,6 +359,7 @@ HRESULT hcn_create_nat_network(GUID *network_id)
     if (network && pfnCloseNet)
         pfnCloseNet(network);
 
+    ReleaseSRWLockExclusive(&g_network_lock);
     return hr;
 }
 
@@ -368,8 +375,11 @@ HRESULT hcn_create_internal_network(GUID *network_id)
 
     *network_id = APPSANDBOX_INTERNAL_GUID;
 
-    if (hcn_network_exists(&APPSANDBOX_INTERNAL_GUID))
+    AcquireSRWLockExclusive(&g_network_lock);
+    if (hcn_network_exists(&APPSANDBOX_INTERNAL_GUID)) {
+        ReleaseSRWLockExclusive(&g_network_lock);
         return S_OK;
+    }
 
     swprintf_s(settings, 1024,
         L"{"
@@ -386,6 +396,7 @@ HRESULT hcn_create_internal_network(GUID *network_id)
     }
     if (network && pfnCloseNet) pfnCloseNet(network);
 
+    ReleaseSRWLockExclusive(&g_network_lock);
     return hr;
 }
 
@@ -402,8 +413,11 @@ HRESULT hcn_create_external_network(GUID *network_id, const wchar_t *adapter_nam
 
     *network_id = APPSANDBOX_EXTERNAL_GUID;
 
-    if (hcn_network_exists(&APPSANDBOX_EXTERNAL_GUID))
+    AcquireSRWLockExclusive(&g_network_lock);
+    if (hcn_network_exists(&APPSANDBOX_EXTERNAL_GUID)) {
+        ReleaseSRWLockExclusive(&g_network_lock);
         return S_OK;
+    }
 
     /* Use specified adapter, or auto-detect */
     if (adapter_name && adapter_name[0] != L'\0') {
@@ -412,6 +426,7 @@ HRESULT hcn_create_external_network(GUID *network_id, const wchar_t *adapter_nam
     } else {
         if (!get_default_adapter_name(adapter, 256)) {
             ui_log(L"Error: No connected network adapter found for External network.");
+            ReleaseSRWLockExclusive(&g_network_lock);
             return E_FAIL;
         }
     }
@@ -432,6 +447,7 @@ HRESULT hcn_create_external_network(GUID *network_id, const wchar_t *adapter_nam
     }
     if (network && pfnCloseNet) pfnCloseNet(network);
 
+    ReleaseSRWLockExclusive(&g_network_lock);
     return hr;
 }
 
@@ -486,7 +502,7 @@ HRESULT hcn_create_endpoint(const GUID *network_id, GUID *endpoint_id,
             L"\"IpConfigurations\":[{\"IpAddress\":\"%S\",\"PrefixLength\":24}]"
             L"%s}", net_guid_str, nat_ip, mac_settings);
     } else if (IsEqualGUID(network_id, &APPSANDBOX_NAT_GUID)) {
-        pick_nat_base_once();
+        hcn_nat_subnet_base();
         swprintf_s(settings, 1024,
             L"{"
             L"\"SchemaVersion\":{\"Major\":2,\"Minor\":0},"