From 0891b408467f4f712dfd2600c32037c406f09e15 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Claus=20Lensb=C3=B8l?= <claus@tailscale.com>
Date: Wed, 9 Sep 2026 15:50:28 -0400
Subject: [PATCH] WIP EXPERIMENT

---
 net/dns/resolver/forwarder_android.go | 18 ++++++++++++++++++
 net/netns/netns_android.go            |  7 +++++++
 2 files changed, 25 insertions(+)
 create mode 100644 net/dns/resolver/forwarder_android.go

diff --git a/net/dns/resolver/forwarder_android.go b/net/dns/resolver/forwarder_android.go
new file mode 100644
index 000000000..c837fc3f6
--- /dev/null
+++ b/net/dns/resolver/forwarder_android.go
@@ -0,0 +1,18 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build android
+
+package resolver
+
+import (
+	"net"
+
+	"tailscale.com/net/netns"
+	"tailscale.com/types/nettype"
+)
+
+func init() {
+	lc := &net.ListenConfig{Control: netns.ControlFuncForDNS()}
+	stdNetPacketListener = nettype.MakePacketListenerWithNetIP(lc)
+}
diff --git a/net/netns/netns_android.go b/net/netns/netns_android.go
index 7c5fe3214..224e543ea 100644
--- a/net/netns/netns_android.go
+++ b/net/netns/netns_android.go
@@ -106,3 +106,10 @@ func controlC(network, address string, c syscall.RawConn) error {
 	}
 	return sockErr
 }
+
+// ControlFuncForDNS returns the Android-specific socket control function that
+// calls VpnService.protect() and bindSocketToNetwork(). This must be used for
+// DNS forwarder sockets to prevent them from being routed through the VPN.
+func ControlFuncForDNS() func(network, address string, c syscall.RawConn) error {
+	 return controlC
+}