10 files changed, 51 insertions, 5 deletions
diff --git a/net/dns/manager.go b/net/dns/manager.go
index de99fe646..5170d0b78 100644
--- a/net/dns/manager.go
+++ b/net/dns/manager.go
@@ -15,7 +15,6 @@ import (
 	"runtime"
 	"slices"
 	"strings"
-	"sync"
 	"sync/atomic"
 	"time"
 
@@ -65,8 +64,8 @@ type Manager struct {
 	knobs    *controlknobs.Knobs // or nil
 	goos     string              // if empty, gets set to runtime.GOOS
 
-	mu     sync.Mutex // guards following
-	config *Config    // Tracks the last viable DNS configuration set by Set.  nil on failures other than compilation failures or if set has never been called.
+	mu     syncs.Mutex // guards following
+	config *Config     // Tracks the last viable DNS configuration set by Set.  nil on failures other than compilation failures or if set has never been called.
 }
 
 // NewManagers created a new manager from the given config.
@@ -95,6 +94,7 @@ func NewManager(logf logger.Logf, oscfg OSConfigurator, health *health.Tracker,
 		knobs:    knobs,
 		goos:     goos,
 	}
+	syncs.RegisterMutex(&m.mu, "dns.Manager.mu")
 
 	m.ctx, m.ctxCancel = context.WithCancel(context.Background())
 	m.logf("using %T", m.os)
diff --git a/net/dns/resolver/forwarder.go b/net/dns/resolver/forwarder.go
index 5adc43efc..83b28fdb4 100644
--- a/net/dns/resolver/forwarder.go
+++ b/net/dns/resolver/forwarder.go
@@ -267,6 +267,7 @@ func newForwarder(logf logger.Logf, netMon *netmon.Monitor, linkSel ForwardLinkS
 		controlKnobs: knobs,
 		verboseFwd:   verboseDNSForward(),
 	}
+	syncs.RegisterMutex(&f.mu, "resolver.forwarder.mu")
 	f.ctx, f.ctxCancel = context.WithCancel(context.Background())
 	return f
 }
diff --git a/net/dns/resolver/tsdns.go b/net/dns/resolver/tsdns.go
index 3185cbe2b..25916c6c9 100644
--- a/net/dns/resolver/tsdns.go
+++ b/net/dns/resolver/tsdns.go
@@ -249,6 +249,7 @@ func New(logf logger.Logf, linkSel ForwardLinkSelector, dialer *tsdial.Dialer, h
 		dialer:   dialer,
 		health:   health,
 	}
+	syncs.RegisterMutex(&r.mu, "resolver.Resolver.mu")
 	r.forwarder = newForwarder(r.logf, netMon, linkSel, dialer, health, knobs)
 	return r
 }
diff --git a/net/dnscache/dnscache.go b/net/dnscache/dnscache.go
index e222b983f..797d95cc7 100644
--- a/net/dnscache/dnscache.go
+++ b/net/dnscache/dnscache.go
@@ -98,10 +98,16 @@ type Resolver struct {
 
 	sf singleflight.Group[string, ipRes]
 
+	registerMutexOnce sync.Once
+
 	mu      syncs.Mutex
 	ipCache map[string]ipCacheEntry
 }
 
+func (r *Resolver) registerMutex() {
+	syncs.RegisterMutex(&r.mu, "dnscache.Resolver.mu")
+}
+
 // ipRes is the type used by the Resolver.sf singleflight group.
 type ipRes struct {
 	ip, ip6 netip.Addr
@@ -193,6 +199,8 @@ func SetDebugLoggingEnabled(v bool) {
 // If err is nil, ip will be non-nil. The v6 address may be nil even
 // with a nil error.
 func (r *Resolver) LookupIP(ctx context.Context, host string) (ip, v6 netip.Addr, allIPs []netip.Addr, err error) {
+	r.registerMutexOnce.Do(r.registerMutex)
+
 	if r.SingleHostStaticResult != nil {
 		if r.SingleHost != host {
 			return zaddr, zaddr, nil, fmt.Errorf("dnscache: unexpected hostname %q doesn't match expected %q", host, r.SingleHost)
@@ -373,11 +381,13 @@ func (r *Resolver) addIPCache(host string, ip, ip6 netip.Addr, allIPs []netip.Ad
 
 // Dialer returns a wrapped DialContext func that uses the provided dnsCache.
 func Dialer(fwd netx.DialFunc, dnsCache *Resolver) netx.DialFunc {
+	dnsCache.registerMutexOnce.Do(dnsCache.registerMutex)
 	d := &dialer{
 		fwd:         fwd,
 		dnsCache:    dnsCache,
 		pastConnect: map[netip.Addr]time.Time{},
 	}
+	syncs.RegisterMutex(&d.mu, "dnscache.dialer.mu")
 	return d.DialContext
 }
 
@@ -386,11 +396,12 @@ type dialer struct {
 	fwd      netx.DialFunc
 	dnsCache *Resolver
 
-	mu          sync.Mutex
+	mu          syncs.Mutex
 	pastConnect map[netip.Addr]time.Time
 }
 
 func (d *dialer) DialContext(ctx context.Context, network, address string) (retConn net.Conn, ret error) {
+
 	host, port, err := net.SplitHostPort(address)
 	if err != nil {
 		// Bogus. But just let the real dialer return an error rather than
@@ -404,6 +415,7 @@ func (d *dialer) DialContext(ctx context.Context, network, address string) (retC
 		host:    host,
 		port:    port,
 	}
+	syncs.RegisterMutex(&dc.mu, "dnscache.dialCall.mu")
 	defer func() {
 		// On failure, consider that our DNS might be wrong and ask the DNS fallback mechanism for
 		// some other IPs to try.
diff --git a/net/netcheck/netcheck.go b/net/netcheck/netcheck.go
index c5a3d2392..8b22c459b 100644
--- a/net/netcheck/netcheck.go
+++ b/net/netcheck/netcheck.go
@@ -235,6 +235,8 @@ type Client struct {
 	testEnoughRegions      int
 	testCaptivePortalDelay time.Duration
 
+	registerMutexOnce sync.Once
+
 	mu       syncs.Mutex           // guards following
 	nextFull bool                  // do a full region scan, even if last != nil
 	prev     map[time.Time]*Report // some previous reports
@@ -244,6 +246,10 @@ type Client struct {
 	resolver *dnscache.Resolver    // only set if UseDNSCache is true
 }
 
+func (c *Client) registerMutex() {
+	syncs.RegisterMutex(&c.mu, "netcheck.Client.mu")
+}
+
 func (c *Client) enoughRegions() int {
 	if c.testEnoughRegions > 0 {
 		return c.testEnoughRegions
@@ -281,6 +287,7 @@ func (c *Client) vlogf(format string, a ...any) {
 // MakeNextReportFull forces the next GetReport call to be a full
 // (non-incremental) probe of all DERP regions.
 func (c *Client) MakeNextReportFull() {
+	c.registerMutexOnce.Do(c.registerMutex)
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	c.nextFull = true
@@ -291,6 +298,8 @@ func (c *Client) MakeNextReportFull() {
 // the loop started by Standalone, in normal operation in tailscaled incoming
 // STUN replies are routed to this method.
 func (c *Client) ReceiveSTUNPacket(pkt []byte, src netip.AddrPort) {
+	c.registerMutexOnce.Do(c.registerMutex)
+
 	c.vlogf("received STUN packet from %s", src)
 
 	if src.Addr().Is4() {
@@ -782,6 +791,7 @@ func (o *GetReportOpts) getLastDERPActivity(region int) time.Time {
 }
 
 func (c *Client) SetForcePreferredDERP(region int) {
+	c.registerMutexOnce.Do(c.registerMutex)
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	c.ForcePreferredDERP = region
@@ -797,6 +807,7 @@ var hookStartCaptivePortalDetection feature.Hook[func(ctx context.Context, rs *r
 //
 // It may not be called concurrently with itself.
 func (c *Client) GetReport(ctx context.Context, dm *tailcfg.DERPMap, opts *GetReportOpts) (_ *Report, reterr error) {
+	c.registerMutexOnce.Do(c.registerMutex)
 	onlySTUN := false
 	if opts != nil && opts.OnlySTUN {
 		if opts.OnlyTCP443 {
@@ -839,6 +850,7 @@ func (c *Client) GetReport(ctx context.Context, dm *tailcfg.DERPMap, opts *GetRe
 		inFlight:    map[stun.TxID]func(netip.AddrPort){},
 		stopProbeCh: make(chan struct{}, 1),
 	}
+	syncs.RegisterMutex(&rs.mu, "netcheck.reportState.mu")
 	c.curState = rs
 	last := c.last
 
diff --git a/net/netmon/interfaces_darwin.go b/net/netmon/interfaces_darwin.go
index 126040350..757d8697a 100644
--- a/net/netmon/interfaces_darwin.go
+++ b/net/netmon/interfaces_darwin.go
@@ -30,6 +30,11 @@ var ifNames struct {
 	m map[int]string // ifindex => name
 }
 
+var _ = func() bool {
+	syncs.RegisterMutex(&ifNames.Mutex, "netmon.ifNames.Mutex")
+	return true
+}()
+
 func init() {
 	interfaceDebugExtras = interfaceDebugExtrasDarwin
 }
diff --git a/net/netmon/netmon.go b/net/netmon/netmon.go
index 657da04d5..a9b7f756a 100644
--- a/net/netmon/netmon.go
+++ b/net/netmon/netmon.go
@@ -125,6 +125,7 @@ func New(bus *eventbus.Bus, logf logger.Logf) (*Monitor, error) {
 		stop:     make(chan struct{}),
 		lastWall: wallTime(),
 	}
+	syncs.RegisterMutex(&m.mu, "netmon.Monitor.mu")
 	m.changed = eventbus.Publish[ChangeDelta](m.b)
 	st, err := m.interfaceStateUncached()
 	if err != nil {
diff --git a/net/ping/ping.go b/net/ping/ping.go
index 8e16a692a..bf87d6f74 100644
--- a/net/ping/ping.go
+++ b/net/ping/ping.go
@@ -81,13 +81,15 @@ func New(ctx context.Context, logf logger.Logf, lp ListenPacketer) *Pinger {
 		panic("net/ping: New:" + err.Error())
 	}
 
-	return &Pinger{
+	p := &Pinger{
 		lp:      lp,
 		Logf:    logf,
 		timeNow: time.Now,
 		id:      binary.LittleEndian.Uint16(id[:]),
 		pings:   make(map[uint16]outstanding),
 	}
+	syncs.RegisterMutex(&p.mu, "ping.Pinger.mu")
+	return p
 }
 
 func (p *Pinger) mkconn(ctx context.Context, typ, addr string) (net.PacketConn, error) {
diff --git a/net/portmapper/portmapper.go b/net/portmapper/portmapper.go
index 16a981d1d..989a7207d 100644
--- a/net/portmapper/portmapper.go
+++ b/net/portmapper/portmapper.go
@@ -266,6 +266,7 @@ func NewClient(c Config) *Client {
 		netMon:   c.NetMon,
 		onChange: c.OnChange,
 	}
+	syncs.RegisterMutex(&ret.mu, "portmapper.Client.mu")
 	if buildfeatures.HasPortMapper {
 		// TODO(bradfitz): move this to method on netMon
 		ret.ipAndGateway = netmon.LikelyHomeRouterIP
diff --git a/net/tsdial/tsdial.go b/net/tsdial/tsdial.go
index 065c01384..669055a49 100644
--- a/net/tsdial/tsdial.go
+++ b/net/tsdial/tsdial.go
@@ -75,6 +75,8 @@ type Dialer struct {
 	// If nil, it's not used.
 	NetstackDialUDP func(context.Context, netip.AddrPort) (net.Conn, error)
 
+	registerMutexOnce sync.Once
+
 	peerClientOnce sync.Once
 	peerClient     *http.Client
 
@@ -142,6 +144,7 @@ func (d *Dialer) SetExitDNSDoH(doh string) {
 	if !buildfeatures.HasUseExitNode {
 		return
 	}
+	d.registerMutexOnce.Do(d.registerMutex)
 	d.mu.Lock()
 	defer d.mu.Unlock()
 	if d.exitDNSDoHBase == doh {
@@ -193,9 +196,15 @@ func (d *Dialer) Close() error {
 	return nil
 }
 
+func (d *Dialer) registerMutex() {
+	syncs.RegisterMutex(&d.mu, "tsdial.Dialer.mu")
+}
+
 // SetNetMon sets d's network monitor to netMon.
 // It is a no-op to call SetNetMon with the same netMon as the current one.
 func (d *Dialer) SetNetMon(netMon *netmon.Monitor) {
+	d.registerMutexOnce.Do(d.registerMutex)
+
 	d.mu.Lock()
 	defer d.mu.Unlock()
 	if d.netMon == netMon {
@@ -220,12 +229,14 @@ func (d *Dialer) SetNetMon(netMon *netmon.Monitor) {
 // NetMon returns the Dialer's network monitor.
 // It returns nil if SetNetMon has not been called.
 func (d *Dialer) NetMon() *netmon.Monitor {
+	d.registerMutexOnce.Do(d.registerMutex)
 	d.mu.Lock()
 	defer d.mu.Unlock()
 	return d.netMon
 }
 
 func (d *Dialer) SetBus(bus *eventbus.Bus) {
+	d.registerMutexOnce.Do(d.registerMutex)
 	d.mu.Lock()
 	defer d.mu.Unlock()
 	if d.bus == bus {