[deepakgudiseva-nexthop]

Pre-submission checklist

• I've ran the linters locally and fixed lint errors related to the files I modified in this PR. You can install the linters by running pip install -r requirements-dev.txt && pre-commit install
• pre-commit run

Summary

Use-after-free in SwSwitch::stop(): the neighbor-cache state-update lambdas capture this (NeighborCacheImpl), but stop() destroys the caches (nUpdater_.reset()) before stopThreads() drains pendingUpdates_. A queued neighbor update then reads sw_ through freed memory and faults in SwitchIdScopeResolver::scope(), so the agent dies during a graceful exit and loses its warm-boot state. Reordering stop() is not an option: ~NeighborUpdater waits on the neighbor-cache evb that stopThreads() has already joined.

Fix: the lambdas capture sw, intfID and needL2EntryForNeighbor by value, as getUpdateFnToProgramPendingEntryForVlan already does. flushEntryFromSwitchState and RemoteNeighborUpdater::processChangedInterface, which had the same this capture, become static.

Test Plan

New SwSwitchTestNbrs.neighborUpdatesOutliveTheirCache queues updates from a standalone ArpCache, destroys the cache, then lets them run and checks they landed. The UAF itself is only reported under ASAN.

Hardware, OSS build, warm restarts of fboss_sw_agent with many resolved neighbors and MALLOC_CONF=junk:free so the dangling read always faults:

• before: SIGSEGV in NeighborCacheImpl<T>::getUpdateFnToProgramEntry lambda <- SwSwitch::handlePendingUpdates <- stopThreads on 7/7 stops
• after: 8/8 stops clean, no core

[deepakgudiseva-nexthop]

/autorebase