Fix use-after-free in DudesCab::Finish() at teardown

[NLygitadm]

Problem

When a DudesCab coexists with another output controller (in my case a TeensyStripController driving an addressable backboard), quitting a table intermittently crashes the process with double free or corruption (out) / free(): invalid pointer.

Root cause

Cabinet teardown runs OutputControllerList::Finish(), which calls DudesCab::ClearDevices() and frees the shared static Device (s_devices). ~DudesCab() then calls Finish() a second time, which still holds the now-dangling m_dev and dereferences it via m_dev->AllOff() — a use-after-free. It is timing-dependent, hence intermittent. Confirmed with AddressSanitizer, which pinpointed the freed access.

Fix

Null out m_dev right after AllOff() in Finish(), so a subsequent Finish() (from the destructor) becomes a no-op. This mirrors the pattern already used in the disconnect path of UpdateOutputs() (m_dev->AllOff(); m_dev = nullptr;). No behavior change for the normal single-Finish() path: a null m_dev is already guarded throughout the class, and m_dev is re-populated on setup.

Testing

• Built Release for Linux x64.
• Ran on a PinCabOS cabinet with a DudesCab (LedWiz #90) + a TeensyStripController driven together: repeated table open/close, no more crashes.
• AddressSanitizer build: the reported use-after-free at teardown is gone.

🤖 Generated with Claude Code

[jsm174]

Thanks for this. I have a couple different strategies with ai, where I always feed it original C# source code, so we try to stay as 1:1 as possible.

Can you try the latest, see #66

[NLygitadm]

Thanks @jsm174 — #66 is the cleaner fix, and keeping it 1:1 with the C# source is clearly the right call. Removing the Finish() call from the destructor altogether addresses the same teardown use-after-free we hit, without the extra m_dev = nullptr; guard.

I rebuilt libdof at #66 (master 0383246) and deployed it on our Linux cabinet (vpinfe / PinCabOS) with a Dude's Cab + Teensy strip controller running together — the intermittent double free / free(): invalid pointer on table exit is gone, and both controllers initialize and reconnect cleanly.

Closing this one in favor of #66. Thanks for the quick turnaround! 🙏