根因完全清楚。TestPacketSniffer_Normal 用 key 1.1.1.1:1111 → 2.2.2.2:2222，成功 sniff 后调用 sniffer.Close() 但并未从 pool 中删除（Close() ≠ Remove()），session 还留在 DefaultPacketSnifferSessionMgr 的 pool 里。TestPacketSniffer_Mismatched 第一次循环用同样的 key 2.2.2.2:2222，GetOrCreate 直接返回了 Normal 留下的已缓存 sniffer，它已经有 sniff 结果，立刻命中，触发 t.Fatal。

修复方法：两个测试各自用独立的 NewPacketSnifferPool() 实例，消除全局状态污染：

Author: MaurUppi

.github/workflows/dns-race.yml

@@ -49,6 +49,5 @@ jobs:
       - name: Run race detector for control package
         # Exclude control/kern/tests: it requires a separate `go generate` step
         # (make ebpf-test) and needs kernel privileges to load BPF programs.
-        # TestPacketSniffer_Mismatched is a pre-existing flaky test unrelated to
-        # DNS changes; skip it here so it does not block race detection.
+        # It is covered by the dedicated bpf-test / kernel-test workflows.
         run: go test -race -v -run '.' $(go list ./control/... | grep -v 'control/kern/tests')

control/packet_sniffer_pool_test.go

@@ -19,9 +19,10 @@ var testPacketSnifferData = []string{
 }
 
 func TestPacketSniffer_Normal(t *testing.T) {
+	mgr := NewPacketSnifferPool()
 	for _, _data := range testPacketSnifferData {
 		data, _ := hex.DecodeString(_data)
-		sniffer, _ := DefaultPacketSnifferSessionMgr.GetOrCreate(PacketSnifferKey{
+		sniffer, _ := mgr.GetOrCreate(PacketSnifferKey{
 			LAddr: netip.MustParseAddrPort("1.1.1.1:1111"),
 			RAddr: netip.MustParseAddrPort("2.2.2.2:2222"),
 		}, nil)
@@ -41,10 +42,11 @@ func TestPacketSniffer_Normal(t *testing.T) {
 }
 
 func TestPacketSniffer_Mismatched(t *testing.T) {
+	mgr := NewPacketSnifferPool()
 	dst := netip.MustParseAddrPort("2.2.2.2:2222")
 	for _, _data := range testPacketSnifferData {
 		data, _ := hex.DecodeString(_data)
-		sniffer, _ := DefaultPacketSnifferSessionMgr.GetOrCreate(PacketSnifferKey{
+		sniffer, _ := mgr.GetOrCreate(PacketSnifferKey{
 			LAddr: netip.MustParseAddrPort("1.1.1.1:1111"),
 			RAddr: dst,
 		}, nil)