Refresh macOS VPN DNS after pf stabilization

cmd/cli/dns_intercept_darwin.go

@@ -1207,7 +1207,6 @@ func stringSlicesEqual(a, b []string) bool {
 	return true
 }
 
-
 // pfStartStabilization enters stabilization mode, suppressing all pf restores
 // until the VPN's ruleset stops changing. This prevents a death spiral where
 // ctrld and the VPN repeatedly overwrite each other's pf rules.
@@ -1284,6 +1283,10 @@ func (p *prog) pfStabilizationLoop(ctx context.Context, stableRequired time.Dura
 			p.pfStabilizing.Store(false)
 			mainLog.Load().Info().Msgf("DNS intercept: pf stable for %s — restoring anchor rules", stableRequired)
 			p.ensurePFAnchorActive()
+			routes, domainlessServers, exemptions := p.refreshDNSAfterVPNSettle("pf_stabilized")
+			if routes == 0 && domainlessServers == 0 && exemptions == 0 {
+				p.scheduleDNSAfterVPNSettleRefresh("pf_stabilized_followup", pfAnchorRecheckDelayLong)
+			}
 			p.pfLastRestoreTime.Store(time.Now().UnixMilli())
 			return
 		}
@@ -1446,6 +1449,15 @@ func (p *prog) ensurePFAnchorActive() bool {
 	return true
 }
 
+func (p *prog) scheduleDNSAfterVPNSettleRefresh(reason string, delay time.Duration) {
+	time.AfterFunc(delay, func() {
+		if p.dnsInterceptState == nil {
+			return
+		}
+		p.refreshDNSAfterVPNSettle(reason)
+	})
+}
+
 // pfWatchdog periodically checks that our pf anchor is still active.
 // Other programs (e.g., Windscribe desktop app, macOS configd) can replace
 // scheduleDelayedRechecks schedules delayed re-checks after a network change event.