From 93179da91f4cd23d29484d96c5e5dd22de2726ab Mon Sep 17 00:00:00 2001
From: CicerBro <177757655+CicerBro@users.noreply.github.com>
Date: Mon, 10 Aug 2026 17:55:14 +0100
Subject: [PATCH 1/2] fix(tvOS): clear lingering IPv6 blackhole after exit node
 deselect

setTunnelNetworkSettings keeps the previous IPv6 config when the
property is left nil. Always assign empty IPv6 settings so the ::/0
blackhole from an exit node does not stick after deselection.
---
 .../PacketTunnelProviderSettingsManager.swift               | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift b/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift
index 99d4411..9d3e61f 100644
--- a/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift
+++ b/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift
@@ -129,6 +129,12 @@ class PacketTunnelProviderSettingsManager {
                         ipv6Settings.includedRoutes = v6Routes
                     }
                     tunnelNetworkSettings.ipv6Settings = ipv6Settings
+                } else {
+                    // Always assign IPv6 settings explicitly: leaving the property nil
+                    // makes setTunnelNetworkSettings KEEP the previously applied IPv6
+                    // config, so the ::/0 blackhole installed while an exit node was
+                    // selected would linger after deselect and keep black-holing traffic.
+                    tunnelNetworkSettings.ipv6Settings = NEIPv6Settings(addresses: [], networkPrefixLengths: [])
                 }
                 
                 tunnelNetworkSettings.mtu = 1280

From 4a53cf3946b9282759882207d9b8dc70571e7897 Mon Sep 17 00:00:00 2001
From: CicerBro <177757655+CicerBro@users.noreply.github.com>
Date: Mon, 10 Aug 2026 20:59:45 +0100
Subject: [PATCH 2/2] fix: use dummy IPv6 address when clearing tunnel IPv6
 routes

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../PacketTunnelProviderSettingsManager.swift                | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift b/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift
index 9d3e61f..89a6a3e 100644
--- a/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift
+++ b/NetbirdNetworkExtension/PacketTunnelProviderSettingsManager.swift
@@ -134,7 +134,10 @@ class PacketTunnelProviderSettingsManager {
                     // makes setTunnelNetworkSettings KEEP the previously applied IPv6
                     // config, so the ::/0 blackhole installed while an exit node was
                     // selected would linger after deselect and keep black-holing traffic.
-                    tunnelNetworkSettings.ipv6Settings = NEIPv6Settings(addresses: [], networkPrefixLengths: [])
+                    let ipv6Settings = NEIPv6Settings(addresses: [Self.ipv6BlackholeAddress], networkPrefixLengths: [Self.ipv6BlackholePrefix])
+                    // Explicitly clear any previously-applied IPv6 routes.
+                    ipv6Settings.includedRoutes = []
+                    tunnelNetworkSettings.ipv6Settings = ipv6Settings
                 }
                 
                 tunnelNetworkSettings.mtu = 1280