fix(network/tracer): fix data race on conntrackerTelemetry.lastRegisters

Collect() did a non-atomic read-modify-write on the package-level
conntrackerTelemetry.lastRegisters field. When two Prometheus Gather
ticks overlapped, both goroutines raced on this field.

Move lastRegisters to the ebpfConntracker instance and use a CAS loop
(CompareAndSwap) so the read-modify-write is atomic and the stored
counter only moves forward. Making the baseline per-instance also fixes
a regression on module restart: a new conntracker gets a fresh
telemetry map, so the package-level baseline (which retained the old
map's counter) would have suppressed all deltas until the new counter
exceeded the old total.

Found via a race-detector-enabled build in staging (see #54333).

Author: pgimalac

pkg/network/tracer/ebpf_conntracker.go

@@ -13,6 +13,7 @@ import (
 	"fmt"
 	"io"
 	"net/netip"
+	"sync/atomic"
 	"time"
 
 	manager "github.com/DataDog/ebpf-manager"
@@ -62,14 +63,12 @@ var conntrackerTelemetry = struct {
 	getsTotal           telemetryComp.Counter
 	unregistersTotal    telemetryComp.Counter
 	registersTotal      *prometheus.Desc
-	lastRegisters       uint64
 }{
 	telemetryimpl.GetCompatComponent().NewHistogram(ebpfConntrackerModuleName, "gets_duration_nanoseconds", []string{}, "Histogram measuring the time spent retrieving connection tuples from the EBPF map", defaultBuckets),
 	telemetryimpl.GetCompatComponent().NewHistogram(ebpfConntrackerModuleName, "unregisters_duration_nanoseconds", []string{}, "Histogram measuring the time spent deleting connection tuples from the EBPF map", defaultBuckets),
 	telemetryimpl.GetCompatComponent().NewCounter(ebpfConntrackerModuleName, "gets_total", []string{}, "Counter measuring the total number of attempts to get connection tuples from the EBPF map"),
 	telemetryimpl.GetCompatComponent().NewCounter(ebpfConntrackerModuleName, "unregisters_total", []string{}, "Counter measuring the total number of attempts to delete connection tuples from the EBPF map"),
 	prometheus.NewDesc(ebpfConntrackerModuleName+"__registers_total", "Counter measuring the total number of attempts to update/create connection tuples in the EBPF map", nil, nil),
-	0,
 }
 
 type ebpfConntracker struct {
@@ -83,6 +82,13 @@ type ebpfConntracker struct {
 	stop chan struct{}
 
 	isPrebuilt bool
+
+	// lastRegisters is the baseline for the registers_total delta reported via
+	// Collect. It is per-instance so that a module restart (which builds a new
+	// ebpfConntracker with a fresh telemetry map) starts from zero instead of
+	// inheriting the previous map's counter, which would suppress all deltas
+	// until the new counter exceeds the old one.
+	lastRegisters atomic.Uint64
 }
 
 var ebpfConntrackerCORECreator func(cfg *config.Config) (*manager.Manager, error) = getCOREConntracker
@@ -411,12 +417,29 @@ func (e *ebpfConntracker) Collect(ch chan<- prometheus.Metric) {
 	if err := e.telemetryMap.Lookup(&zero, ebpfTelemetry); err != nil {
 		log.Tracef("error retrieving the telemetry struct: %s", err)
 	} else {
-		delta := ebpfTelemetry.Registers - conntrackerTelemetry.lastRegisters
-		conntrackerTelemetry.lastRegisters = ebpfTelemetry.Registers
+		delta := e.computeRegistersDelta(ebpfTelemetry.Registers)
 		ch <- prometheus.MustNewConstMetric(conntrackerTelemetry.registersTotal, prometheus.CounterValue, float64(delta))
 	}
 }
 
+// computeRegistersDelta atomically computes the delta between the current and
+// last-seen register count, and updates the last-seen value. It is safe to call
+// concurrently (e.g. when two Prometheus Gather ticks overlap). A CAS loop
+// ensures the stored counter only moves forward, so a stale map lookup can
+// neither regress lastRegisters nor report a duplicate (or underflowing) delta.
+// The baseline is per-conntracker-instance so a module restart resets it.
+func (e *ebpfConntracker) computeRegistersDelta(currentRegisters uint64) uint64 {
+	for {
+		last := e.lastRegisters.Load()
+		if currentRegisters <= last {
+			return 0
+		}
+		if e.lastRegisters.CompareAndSwap(last, currentRegisters) {
+			return currentRegisters - last
+		}
+	}
+}
+
 func getManager(cfg *config.Config, buf io.ReaderAt, opts manager.Options, buildMode buildmode.Type) (*manager.Manager, error) {
 	conntrackMaps := []*manager.Map{
 		{Name: probes.ConntrackMap},