`dnat_packet` can modify the packet's destination IP/port, but it never sets `PacketMeta`'s `dst_natted` flag when it does so. This makes `PacketMeta::is_dst_natted()` / display output inaccurate and weakens the intended "double NAT" protections. Set `dst_natted(true)` when `modified` is true.

debug_assert!(
    !packet.meta().is_dst_natted(),
    "Trying to apply double source NAT to packet!"
);

</details>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@flow-filter/src/lib.rs`:
- Around line 353-370: The function maybe_tag_with_flow_key currently returns
immediately if packet.meta().flow_info.is_some(), which causes stale flow-info
to prevent capturing the pre-static-NAT FlowKey; change the logic so you do not
skip tagging for packets that will be invalidated: either call
should_invalidate_flow (or perform the invalidation check used by
process_packet) before deciding to skip, or invert the guard to only skip
tagging when an active/reusable flow remains (i.e., when
meta().flow_info.is_some() AND the flow is not slated for invalidation). Update
maybe_tag_with_flow_key (and the duplicate logic around lines ~471-482) to
consult should_invalidate_flow/process_packet’s invalidation predicate and only
return early when the existing flow is still valid/active; otherwise proceed to
compute FlowKey::try_from(net::flow_key::Uni(&*packet)) and set
packet.meta_mut().flow_key as before.

In `@flow-filter/src/tests.rs`:
- Around line 45-66: The current helper functions (needs_masquerade,
needs_static_nat, needs_port_forwarding, needs_no_nat) treat static NAT as
mutually exclusive with masquerade/port-forwarding and ignore the src/dst split;
update them to be orthogonal so tests can assert stateful NAT and
port-forwarding independently from source-vs-destination static NAT. Replace the
exclusory helpers with independent predicate helpers such as
is_stateful_nat(packet) (checks packet.meta().requires_stateful_nat()),
is_static_nat_src(packet) and is_static_nat_dst(packet) (use the new src/dst
static NAT flags on packet.meta()), and is_port_forwarding(packet) or
is_port_forwarding_src/dst as appropriate (check
packet.meta().requires_port_forwarding() per direction if available); remove
combinations that assume mutual exclusion (e.g., don't AND-not static-nat inside
is_stateful_nat or is_port_forwarding) so tests can combine these predicates to
express mixed static+masquerade/port-forwarding cases.

In `@nat/src/stateless/nf.rs`:
- Around line 254-257: destination_nat() is mutating embedded ICMP-error packets
without validating checksums; mirror source_nat() by invoking
validate_checksums_icmp() before calling
Self::translate_icmp_inner_packet_src_if_any so malformed ICMP errors are not
rewritten. Locate the block using Self::is_icmp_inner_translation_candidate and
add a checksum validation guard (same function used in source_nat) that returns
early on invalid checksums, then proceed to call
translate_icmp_inner_packet_src_if_any only when validate_checksums_icmp()
succeeds.

---

Nitpick comments:
In `@config/src/external/overlay/validation_tests.rs`:
- Line 1214: Rename the test functions whose names end with `_rejected` to
`_passes` to reflect their updated assertions: change
`test_stateless_plus_stateful_rejected` to `test_stateless_plus_stateful_passes`
and the other similar function at the second location (previously named with
`_rejected`) to use `_passes`; update any references and test attributes (e.g.,
`#[test]`) so the test names and failure reports match the new "passes"
expectation.

In `@nat/src/icmp_handler/nf.rs`:
- Around line 226-227: The code unconditionally sets both
packet.meta_mut().set_static_nat_src(true) and
packet.meta_mut().set_static_nat_dst(true), which is non-obvious to readers; add
a concise inline comment next to these calls explaining that both flags are set
because which direction requires static NAT depends on peering configuration and
the StatelessNat processor will perform a no-op for directions without a mapping
(so setting both is safe). Reference the packet.meta_mut() calls and the
StatelessNat processor in your comment so future maintainers understand the
invariant.

In `@nat/src/stateless/test.rs`:
- Around line 605-610: The test helpers that call build_test_ipv4_packet
currently always enable both per-direction NAT flags via
packet.meta_mut().set_static_nat_src(true) and set_static_nat_dst(true), so they
never exercise src-only or dst-only behavior; update the helper(s) to accept
parameters (e.g., static_nat_src: bool, static_nat_dst: bool) and set those
flags based on the parameters, or add two new focused tests that call the helper
and set only packet.meta_mut().set_static_nat_src(true) /
set_static_nat_dst(false) and vice versa to cover src-only and dst-only paths;
ensure the code paths using packet.meta_mut(), build_test_ipv4_packet, and any
callers are updated to pass the new parameters or the new tests are added
alongside the existing ones.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nat/src/stateless/nf.rs`:
- Around line 191-213: The code mutates outer source IP/port in source_nat()
(translate_src/translate_src_port) before validate_checksums_icmp(), which can
break ICMPv6 checksum validation; move the ICMP error-path checks so
is_icmp_inner_translation_candidate(packet) and validate_checksums_icmp(packet)
(and the subsequent translate_icmp_inner_packet_dst_if_any call) are performed
before any outer-source mutation, or alternately perform checksum validation
against the original outer src by capturing it prior to
translate_src/translate_src_port; ensure modified is only updated after
successful translations and that translate_icmp_inner_packet_dst_if_any still
runs when validation passes.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@nat/src/lib.rs`:
- Line 33: The test module is being compiled unconditionally via the `mod test;`
declaration; add a test-only cfg attribute so the `test` module is only included
in test builds by annotating the `mod test;` line with `#[cfg(test)]` (i.e.,
gate the `test` module with the test configuration) to prevent compiling tests
into non-test/release builds and reduce build size/time.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nat/src/icmp_handler/icmp_error_msg.rs`:
- Around line 50-52: The match arm mapping
IcmpErrorMsgError::NoTranslationPossible to DoneReason::InternalFailure is
incorrect; change that arm to return the semantic DoneReason for expected
non-translatable packets (e.g. DoneReason::NoTranslationPossible or
DoneReason::NoTranslation if that’s the existing enum variant) instead of
InternalFailure, update the match to use the correct DoneReason variant in the
function handling IcmpErrorMsgError, and adjust/add tests to assert the new
mapping for NoTranslationPossible.

---

Outside diff comments:
In `@net/src/flows/flow_key.rs`:
- Around line 578-585: The FlowKey Hash implementation is directional while
TcpProtoKey/UdpProtoKey equality treats port pairs symmetrically, so implement a
canonical (order-independent) hashing for the protocol-port part: in the Hash
for FlowKey (the impl Hash for FlowKey function) replace the directional calls
to proto_key_info.hash_src(state) and proto_key_info.hash_dst(state) with a
single canonical hashing step that orders the (src_ip, src_port) vs (dst_ip,
dst_port) pair deterministically (e.g., compare src_ip/dst_ip and for equal IPs
compare ports or simply use min/max for ports) and then hash the protocol +
ordered port pair; this keeps FlowKey::hash consistent with
TcpProtoKey/UdpProtoKey equality and fixes map lookup/removal mismatches.