From 3a5afc335885f535806232313e6d4b9d805abb2d Mon Sep 17 00:00:00 2001
From: Andrew Lytvynov <awly@tailscale.com>
Date: Fri, 20 Mar 2026 11:44:54 -0700
Subject: [PATCH] feature/conn25: guard against an index out of bounds panic
 (#19066)

Updates #cleanup

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
---
 feature/conn25/conn25.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/feature/conn25/conn25.go b/feature/conn25/conn25.go
index 2e6394d2c..d1ee4f952 100644
--- a/feature/conn25/conn25.go
+++ b/feature/conn25/conn25.go
@@ -534,6 +534,9 @@ func (c *client) reserveAddresses(domain dnsname.FQDN, dst netip.Addr) (addrs, e
 		return existing, nil
 	}
 	appNames, _ := c.config.appNamesByDomain[domain]
+	if len(appNames) == 0 {
+		return addrs{}, fmt.Errorf("no app names found for domain %q", domain)
+	}
 	// only reserve for first app
 	app := appNames[0]
 	mip, err := c.magicIPPool.next()