fix(vpn): resolve ERR_QUIC_PROTOCOL_ERROR and DNS failures on Android 16 TUN mode (issue #32)

Root cause: FakeDNSProxy forwarded non-DNS UDP (QUIC) to upstream SOCKS5
UDP_ASSOCIATE, which rejects non-53 targets and closes the association,
black-holing subsequent DNS queries. IPv6 ::/0 was also routed into the
TUN without an IPv6 DNS server to advertise, so IPv6 QUIC had no path.

Changes (uniform across all Android versions for easier debugging):

* MasterDnsVpnService.kt
  - Drop IPv6 ::/0 route and fc00::1 address from VpnService.Builder;
    FakeDNSProxy has no IPv6 DNS to advertise and upstream SOCKS5
    UDP_ASSOCIATE rejects non-53 traffic, so ::/0 only black-holes IPv6
    QUIC. Re-enablement conditions documented in ponytail comment.
  - setBlocking(true) on the TUN fd: tun2socks/gVisor fdbased reads
    require a blocking fd to avoid busy-loop polling.
  - Add NetworkCallback.onLost override calling setUnderlyingNetworks(null)
    so Android 16 does not retain stale underlying-network state after
    onLost fires (onAvailable only set it, never reset).
  - TUN MTU 1500 to 1400 on both Builder.setMtu and the startTunBridge
    call, leaving headroom for SOCKS5/transport overhead so QUIC
    datagrams do not exceed the upstream path MTU and black-hole.

* mobile/mobile.go
  - StartTun engine.Key.MTU 1500 to 1400 to match the Android side.

* mobile/tun/fakedns_proxy.go
  - Stop forwarding non-53 UDP to upstream. Browsers QUIC probes now
    time out fast and fall back to TCP instead of hanging on a rejected
    UDP_ASSOCIATE that would also kill following DNS queries.
  - Parse atyp==4 (IPv6) BND address in the UDP_ASSOCIATE reply so the
    forward-compat path is correct when IPv6 is re-enabled later.

Author: Hidden-Node

android/app/src/main/java/com/masterdns/vpn/service/MasterDnsVpnService.kt

@@ -287,21 +287,17 @@ class MasterDnsVpnService : VpnService() {
 
                 val builder = Builder()
                     .setSession(getString(R.string.app_name))
-                    .setMtu(1500)
+                    .setMtu(1400)
                     .addAddress(if (globalSettings.fakeDnsEnabled) "172.19.0.1" else "10.0.0.2", if (globalSettings.fakeDnsEnabled) 30 else 32)
                     .addRoute("0.0.0.0", 0)
+                    .setBlocking(true) // tun2socks/gVisor requires blocking fd reads
 
-                // Prevent IPv6 DNS leaks: if we don't route IPv6 and provide an IPv6 DNS,
-                // Android may leak DNS requests to the cellular network's IPv6 DNS server,
-                // resulting in hijacked IPs like 10.10.34.36 from the ISP.
-                try {
-                    builder.addAddress("fc00::1", 128)
-                    builder.addRoute("::", 0)
-                    // We don't add fc00::1 to dns servers here because Android sometimes rejects it,
-                    // but routing ::/0 forces all IPv6 traffic (including DNS) into the TUN.
-                } catch (e: Exception) {
-                    VpnManager.appendLog("IPv6 routing skipped: ${e.message}")
-                }
+                // ponytail: IPv6 NOT routed into the TUN across all Android versions.
+                // FakeDNSProxy only has IPv4 DNS to advertise and upstream SOCKS5 UDP_ASSOCIATE
+                // rejects non-53 traffic (fakedns_proxy.go:339-345, socks_manager.go:665), so
+                // routing ::/0 black-holes IPv6 QUIC on every Android version, not just 16+.
+                // Re-enable when FakeDNSProxy parses atyp==4 BND AND an IPv6 DNS is configured
+                // AND upstream SOCKS5 carries non-DNS IPv6 UDP.
 
                 vpnDnsServers.forEach { builder.addDnsServer(it) }
                 if (globalSettings.fakeDnsEnabled) {
@@ -368,7 +364,7 @@ class MasterDnsVpnService : VpnService() {
 
                 if (globalSettings.fakeDnsEnabled) {
                     VpnManager.appendLog("Starting DNS-aware TUN bridge...")
-                    mobile.Mobile.startTunBridge(vpnInterface!!.fd.toLong(), 1500L, "127.0.0.1:$socksPort")
+                    mobile.Mobile.startTunBridge(vpnInterface!!.fd.toLong(), 1400L, "127.0.0.1:$socksPort")
                     tunBridgeActive = true
                     VpnManager.appendLog("DNS-aware TUN bridge started")
                 } else {
@@ -384,10 +380,16 @@ class MasterDnsVpnService : VpnService() {
                         val caps = cm.getNetworkCapabilities(network)
                         if (caps == null || caps.hasTransport(android.net.NetworkCapabilities.TRANSPORT_VPN)) return
                         if (isStopping) return
-                        
+
                         VpnManager.appendLog("Underlying network changed, updating VPN underlying network...")
                         setUnderlyingNetworks(arrayOf(network))
                     }
+
+                    override fun onLost(network: android.net.Network) {
+                        if (isStopping) return
+                        VpnManager.appendLog("Underlying network lost, resetting VPN underlying network...")
+                        setUnderlyingNetworks(null)
+                    }
                 }
                 try {
                     val request = android.net.NetworkRequest.Builder()

mobile/mobile.go

@@ -109,7 +109,7 @@ func handleTracking(c net.Conn, realProxyAddr string) {
 	defer server.Close()
 
 	tcClient := &trackingConn{
-		Conn: c,
+		Conn:    c,
 		onRead:  func(n int64) { atomic.AddInt64(&trackedUp, n) },
 		onWrite: func(n int64) { atomic.AddInt64(&trackedDown, n) },
 	}
@@ -210,7 +210,9 @@ func StartTun(fd int64, proxyAddr string) {
 	key := &engine.Key{
 		Proxy:  "socks5://" + proxyAddr,
 		Device: fmt.Sprintf("fd://%d", safeFd),
-		MTU:    1500,
+		// ponytail: 1400 leaves headroom for SOCKS5/transport overhead so QUIC
+		// datagrams don't exceed upstream path MTU and black-hole (issue #32).
+		MTU: 1400,
 	}
 
 	engine.Insert(key)
@@ -276,7 +278,6 @@ func StopClient() {
 	StopTunBridge()
 }
 
-
 // IsRunning returns true if the client is currently running.
 func IsRunning() bool {
 	mu.Lock()

mobile/tun/fakedns_proxy.go

@@ -244,6 +244,8 @@ func (p *FakeDNSProxy) handleUDPAssociate(tcpConn net.Conn, atyp byte, targetAdd
 	var realUdpAddr *net.UDPAddr
 	if replyHeader[3] == 1 {
 		realUdpAddr = &net.UDPAddr{IP: net.IP(bndAddr), Port: int(binary.BigEndian.Uint16(bndPortBuf))}
+	} else if replyHeader[3] == 4 {
+		realUdpAddr = &net.UDPAddr{IP: net.IP(bndAddr), Port: int(binary.BigEndian.Uint16(bndPortBuf))}
 	}
 	if realUdpAddr != nil && realUdpAddr.IP.IsUnspecified() {
 		host, _, _ := net.SplitHostPort(p.RealSocksAddr)
@@ -334,9 +336,11 @@ func (p *FakeDNSProxy) handleUDPAssociate(tcpConn net.Conn, atyp byte, targetAdd
 				continue
 			}
 
-			if realUdpAddr != nil {
-				localUdp.WriteToUDP(buf[:n], realUdpAddr)
-			}
+			// ponytail: non-DNS UDP (QUIC, etc.) dropped, not forwarded.
+			// Upstream SOCKS5 UDP_ASSOCIATE rejects non-53 targets
+			// (socks_manager.go:665), forwarding would close the association
+			// and break subsequent DNS queries. Dropping lets the browser's
+			// QUIC probe time out fast and fall back to TCP (issue #32).
 		}
 	}()