Pablo Neira Ayuso [off-list ref] wrote:

quoted

So I believe its needed, concurrent update of ->status is possible and
KCSAN would warn.  Other spots either use READ_ONCE or use test_bit().

There are a more checks for ct->status & NAT_MASK in the tree that I
can see, if you are correct, then maybe a new helper function to check
for NAT_MASK is needed.

I think it would make sense to add a helper, yes.
Independent of this patch of course.