Between accept_fn_ storing a raw PCB and accept() picking it up, the
connection could error (RST, timeout). Without an error callback, lwip
frees the PCB silently, leaving a dangling pointer. When accept() later
creates LWIPRawImpl with it, the use-after-free corrupts the heap.
Fix: register a lightweight error callback (no allocation) in accept_fn_
that nulls the array slot when the PCB is freed. accept() checks for
null and skips freed PCBs. After shifting the array, tcp_arg pointers
are updated for remaining entries.
J. Nick Koston
49024c240b