https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260831135117.574836-1-sw%40simonwunderlich.de?part=10

[...]
> Discovered by: opus-5, sonnet-5 · Missed by: gpt-5-6-sol, sashiko-gemini
> 
> This isn't a bug introduced by this patch, since the removed
> batadv_tt_local_set_flags() did the same unlocked read-modify-write under
> rcu_read_lock(), but it may be worth noting for the rewritten loop in
> batadv_tt_local_transition_new().
> 
> The loop only holds rcu_read_lock(), so it takes neither the hash bucket
> list_lock nor any per-entry lock while doing:
> 
> 	tt_common_entry->flags &= ~BATADV_TT_CLIENT_NEW;
> 
> Can this store be lost against a concurrent RMW on the same u16 from
> batadv_tt_local_add() or batadv_tt_local_set_pending() on another CPU, for
> example one that is OR-ing BATADV_TT_CLIENT_PENDING or
> BATADV_TT_CLIENT_ROAM into the same word?
[...]

Out-of-scope for this patch. And handled in the patch
"batman-adv: tt: transition NEW local entries only under lock"

Regards,
	Sven