Helper: clear ProtectFunc and DefaultResolver so outbound sockets go direct without VPN

ffi_android.go

@@ -316,18 +316,39 @@ func Java_com_sing_vpn_MiniSing_nativeStartHelper(env *C.JNIEnv, cls C.jclass, j
 		return errStr(env, "helper already running")
 	}
 
+	// Helper doesn't use TUN — temporarily clear protect, DNS overrides,
+	// and DefaultDNS so helper's dialers go direct without VPN routing.
+	// This is safe because NewDefault() captures these at creation time,
+	// so main Box's existing dialers are unaffected.
+	savedProtect := dialer.ProtectFunc
+	savedDNS := dialer.DefaultDNS
+	savedResolver := net.DefaultResolver
+	dialer.ProtectFunc = nil
+	dialer.DefaultDNS = ""
+	net.DefaultResolver = &net.Resolver{PreferGo: false}
+
 	helperCtx, helperCancel = context.WithCancel(context.Background())
 	box, err := NewBox(helperCtx, opts)
 	if err != nil {
+		dialer.ProtectFunc = savedProtect
+		dialer.DefaultDNS = savedDNS
+		net.DefaultResolver = savedResolver
 		helperCancel()
 		return errStr(env, "create: "+err.Error())
 	}
 	if err := box.Start(); err != nil {
 		box.Close()
+		dialer.ProtectFunc = savedProtect
+		dialer.DefaultDNS = savedDNS
+		net.DefaultResolver = savedResolver
 		helperCancel()
 		return errStr(env, "start: "+err.Error())
 	}
 	helperBox = box
+	// Restore — main Box's dialers already captured old values, unaffected
+	dialer.ProtectFunc = savedProtect
+	dialer.DefaultDNS = savedDNS
+	net.DefaultResolver = savedResolver
 	log.Println("[ffi] helper started")
 	return errStr(env, "")
 }