[andre487]

Pull request stack

GitHub stack #135.

Merge order: #131 → #132 → #133.

Base: #131. Each PR contains only its own change relative to its parent. After merging lower layers, use gh stack sync to update local tracking and restack the remaining branches.

SOCKS5 UDP receive currently allocates address strings on every IP reply, and constructs two UDPAddr objects for each domain-target reply. Match validated wire addresses directly when their types match and read the validated numeric reply's port without constructing UDPAddr objects. Retain textual matching for different address types, including equivalent IPv4/IPv4-mapped IPv6 replies.

The source-validation policy, concurrency limits and disabled-mode dispatch path are unchanged. This reduces allocation pressure in SOCKS5 with strict validation either enabled or disabled.

Validation: all 331 native tests passed with the race detector. Add reply-policy cases for IPv4/IPv6, both mapped directions, incorrect IP/port and malformed domain-route headers. Tighten the existing steady-state IPv4 allocation budget to zero and extend the receive benchmark to cover all reply types.

Host microbenchmarks on Apple M4 Pro, GOMAXPROCS=1, ten 200 ms samples per scenario, 1200-byte payloads; before/after use identical extended benchmark definitions. CPU/allocation profiles identify address formatting as the original allocation source; after optimization payload copying dominates the receive CPU profile.

Reply path	Before ns/op	After ns/op	Before → after allocations/op
IPv4	132.75	30.80	6 → 0
IPv6	190.75	31.20	6 → 0
Domain target, IPv4 reply	87.33	29.22	4 → 0
Domain target, IPv6 reply	93.16	29.32	4 → 0
IPv4 target, mapped IPv6 reply	136.25	134.55	6 → 6

The first four improvements are statistically significant in benchstat (p < 0.001, n=10). The mapped path retains its allocation-producing compatibility fallback. These are in-memory Go receive costs, not measured VPN throughput or Android JNI/owner-lookup overhead. Full core samples still show zero allocations for guarded UDP reads; no security synchronization is removed to improve synthetic timings.

Benchmark runner and analysis instructions are in the parent PR #131; extended benchmarks use the existing Go benchmark entry point.

APK artifacts

• Download debug APK — signed with the disposable Android debug key
• Download unsigned release APK — verified unsigned

Built from commit 7720c0ae by CI run #446.
Artifacts expire after 14 days. Neither APK uses the MegaProxy release key.