From b70342a2f526c928811d22abc5c6557cecf3458f Mon Sep 17 00:00:00 2001
From: DeFiDude <59237470+DeFiDude@users.noreply.github.com>
Date: Fri, 20 Mar 2026 20:25:47 -0600
Subject: [PATCH] Fix wrong-recipient message delivery via stale outbound link
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When switching between peers, sendDirect() updated _outLinkDestHash to the
new destination before the new link was established, while _outLink still
held the old peer's active link. On the next retry, the hash check passed
(both matched the new peer) but the link object was still connected to the
old peer — delivering the message to the wrong recipient.

Fix: only update _outLinkDestHash in onOutLinkEstablished() when the new
link is actually ready. Use _outLinkPendingHash to track what's being
connected to.
---
 src/reticulum/LXMFManager.cpp | 3 ++-
 src/reticulum/LXMFManager.h   | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/reticulum/LXMFManager.cpp b/src/reticulum/LXMFManager.cpp
index ce49341..3d7f9d6 100644
--- a/src/reticulum/LXMFManager.cpp
+++ b/src/reticulum/LXMFManager.cpp
@@ -187,7 +187,7 @@ bool LXMFManager::sendDirect(LXMFMessage& msg) {
     // Background: establish link for future messages to this peer
     if (!_outLinkPending && (!_outLink || _outLinkDestHash != msg.destHash
         || _outLink.status() == RNS::Type::Link::CLOSED)) {
-        _outLinkDestHash = msg.destHash;
+        _outLinkPendingHash = msg.destHash;
         _outLinkPending = true;
         Serial.printf("[LXMF] Establishing link to %s for future messages\n",
                       msg.destHash.toHex().substr(0, 8).c_str());
@@ -212,6 +212,7 @@ void LXMFManager::onPacketReceived(const RNS::Bytes& data, const RNS::Packet& pa
 void LXMFManager::onOutLinkEstablished(RNS::Link& link) {
     if (!_instance) return;
     _instance->_outLink = link;
+    _instance->_outLinkDestHash = _instance->_outLinkPendingHash;
     _instance->_outLinkPending = false;
     Serial.printf("[LXMF] Outbound link established to %s\n",
                   _instance->_outLinkDestHash.toHex().substr(0, 8).c_str());
diff --git a/src/reticulum/LXMFManager.h b/src/reticulum/LXMFManager.h
index 2c59c95..3ded508 100644
--- a/src/reticulum/LXMFManager.h
+++ b/src/reticulum/LXMFManager.h
@@ -45,7 +45,8 @@ private:
 
     // Outbound link state (opportunistic-first, link upgrades in background)
     RNS::Link _outLink{RNS::Type::NONE};
-    RNS::Bytes _outLinkDestHash;
+    RNS::Bytes _outLinkDestHash;       // Destination the ACTIVE _outLink is for
+    RNS::Bytes _outLinkPendingHash;    // Destination being connected to (not yet established)
     bool _outLinkPending = false;
 
     // Deduplication: recently seen message IDs