fix(net): synchronize Buf.Close with Write/Read to prevent nil-pointer panic

internal/net.Buf had Close() nilling the underlying bytes.Buffer without
taking the rw mutex, racing against concurrent Buf.Write() / Buf.Read()
calls. When the consumer of MultiReadCloser closes mid-download (via
downloader.interrupt()), in-flight chunk-download goroutines could
dereference a nil bytes.Buffer and panic the entire process — matching
the SIGSEGV stack reported in #9190 and one crash mode from #9537.

Make Close acquire the lock and have Read/Write return io.ErrClosedPipe
when the buffer has been nilled, instead of panicking.

Add a race-detector regression test (TestBufCloseWriteRace) that panics
many times without this fix and passes cleanly with it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: okatu-loli

internal/net/buf_race_test.go

@@ -0,0 +1,44 @@
+package net
+
+import (
+	"context"
+	"sync"
+	"testing"
+)
+
+// TestBufCloseWriteRace exercises the race fixed for issue #9537/#9190:
+// Buf.Close() must synchronize with concurrent Buf.Write() calls so that
+// nilling the underlying bytes.Buffer cannot panic an in-flight writer.
+// Run with `go test -race ./internal/net/...` to be meaningful.
+func TestBufCloseWriteRace(t *testing.T) {
+	const iters = 200
+	const writers = 8
+
+	for i := 0; i < iters; i++ {
+		buf := NewBuf(context.Background(), 1024)
+		var wg sync.WaitGroup
+		for w := 0; w < writers; w++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				defer func() {
+					if r := recover(); r != nil {
+						t.Errorf("panic in Write: %v", r)
+					}
+				}()
+				for j := 0; j < 50; j++ {
+					_, _ = buf.Write([]byte("x"))
+				}
+			}()
+		}
+		go func() {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Errorf("panic in Close: %v", r)
+				}
+			}()
+			buf.Close()
+		}()
+		wg.Wait()
+	}
+}

internal/net/request.go

@@ -643,6 +643,10 @@ func (br *Buf) Read(p []byte) (n int, err error) {
 		return 0, io.EOF
 	}
 	br.rw.Lock()
+	if br.buffer == nil {
+		br.rw.Unlock()
+		return 0, io.ErrClosedPipe
+	}
 	n, err = br.buffer.Read(p)
 	br.rw.Unlock()
 	if err == nil {
@@ -672,10 +676,15 @@ func (br *Buf) Write(p []byte) (n int, err error) {
 	}
 	br.rw.Lock()
 	defer br.rw.Unlock()
+	if br.buffer == nil {
+		return 0, io.ErrClosedPipe
+	}
 	n, err = br.buffer.Write(p)
 	return
 }
 
 func (br *Buf) Close() {
+	br.rw.Lock()
+	defer br.rw.Unlock()
 	br.buffer = nil
 }