The background run() thread copies allConnections() then iterates each connection's diags_ map. If a PIConnection is deleted from another thread between the copy and the iteration, dereferencing the pointer is UAF. Add null check and protect diags_ iteration with __device_pool__ lock.