---
id: "bug-1210"
status: "fixed"
status_updated: "2026-09-24"
status_note: ""
component: "controller"
severity: "unknown"
timestamp: "2026-06-26"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 1
files: ["src/controller/ha.c", "src/controller/ha.h"]
tags: ["raft-drive-async", "task-3.2", "snapshot", "slow-lane", "UAF", "feature-flag", "bug-1197", "bug-1198", "liveness"]
related: ["bug-1197", "bug-1198", "bug-1147"]
legacy: true
---

# bug-1210: raft-drive-async task 3.2 snapshot slow-lane offload flag g_drive_async_snapshot_offload defaulted…

## Description
raft-drive-async task 3.2 snapshot slow-lane offload flag g_drive_async_snapshot_offload defaulted ON (=1); header doc also said default ON

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
Snapshot offload borrows a standby endpoint shared with the io_worker epoll loop (not owned, unlike reconnect_lane_fn). With the flag ON the send runs on a slow-lane thread while io_worker can RDHUP-free that endpoint => cross-thread UAF (bug-1197 family). Defaulting ON would ship that UAF; the borrowed-endpoint lifetime discipline is not established until task 3.4.

## Fix
Default the flag OFF (dormant landing, same protocol as task 3.1 peerctrl dispatch). Inline path runs on io_worker, serialized with teardown -> no overlap. Rewrote both the ha.c definition comment and the ha.h accessor doc to state OFF is the production default and 3.4 is the gate that flips it ON. bug-1198 stays open by design until then.

## Verification
_Not recorded (migrated from buglog.json)._

## References
- Related: bug-1197, bug-1198, bug-1147