From 70e7d3f2ea1f00ea4ab9b90173219bb1b2d420f3 Mon Sep 17 00:00:00 2001
From: JackDoan <me@jackdoan.com>
Date: Wed, 14 Oct 2026 11:09:18 -0500
Subject: [PATCH] Hold a pending hybrid responder locked until it is filled in

---
 handshake_manager.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/handshake_manager.go b/handshake_manager.go
index 38f9e003..1cad4a01 100644
--- a/handshake_manager.go
+++ b/handshake_manager.go
@@ -802,6 +802,10 @@ func (hm *HandshakeManager) beginHandshake(via ViaSender, packet []byte, h *head
 			startTime: time.Now(),
 			responder: &hybridResponder{},
 		}
+		// The index is visible to msg3 as soon as it is allocated, so hold the
+		// entry until it is filled in.
+		pending.Lock()
+		defer pending.Unlock()
 		allocIndex = func() (uint32, error) { return hm.allocateIndex(pending) }
 	}