From b7e37f721fb6791279804874b480f10d329e1413 Mon Sep 17 00:00:00 2001
From: rabbitstack <rabbitstack7@gmail.com>
Date: Sat, 25 Jul 2026 16:36:24 +0200
Subject: [PATCH] fix(fs,signature): Eagerly initialize metadata stores

Eagerly initialise the signature/fs metadata worker pool before opening the ETW session. Rundown events fire immediately on session open and must find workers already running to avoid any fallback path executing on the ETW callback goroutine.
---
 internal/bootstrap/bootstrap.go | 3 +++
 pkg/fs/file.go                  | 6 ++++++
 pkg/util/signature/signature.go | 7 +++++++
 3 files changed, 16 insertions(+)

diff --git a/internal/bootstrap/bootstrap.go b/internal/bootstrap/bootstrap.go
index ead9fb3e5..1e5a52361 100644
--- a/internal/bootstrap/bootstrap.go
+++ b/internal/bootstrap/bootstrap.go
@@ -142,6 +142,9 @@ func NewApp(cfg *config.Config, options ...Option) (*App, error) {
 	var engine *rules.Engine
 	var rs *config.RulesCompileResult
 
+	signature.InitStore()
+	fs.InitMetadataStore()
+
 	if cfg.Filters.Rules.Enabled && !cfg.ForwardMode && !cfg.IsCaptureSet() && !cfg.IsFilamentSet() {
 		engine = rules.NewEngine(psnap, cfg)
 		var err error
diff --git a/pkg/fs/file.go b/pkg/fs/file.go
index e766e2f99..d8dfb19b1 100644
--- a/pkg/fs/file.go
+++ b/pkg/fs/file.go
@@ -155,6 +155,12 @@ func GetMetadataStore() *FileMetadataStore {
 	return metadataStore
 }
 
+func InitMetadataStore() {
+	onceMetadataStore.Do(func() {
+		metadataStore = newFileMetadataStore()
+	})
+}
+
 // FileMetadataStore contains metainfo of PE files derived
 // from file creation or DLL loading. Metadata store is
 // invalidated on various signals such as file overwriting
diff --git a/pkg/util/signature/signature.go b/pkg/util/signature/signature.go
index 6dae675fa..5df5ddb8b 100644
--- a/pkg/util/signature/signature.go
+++ b/pkg/util/signature/signature.go
@@ -140,6 +140,13 @@ func GetSignatures() *Signatures {
 	return sigs
 }
 
+// InitStore eagerly initializes the signature store and its worker pool.
+func InitStore() {
+	once.Do(func() {
+		sigs = newSignatures()
+	})
+}
+
 func newSignatures() *Signatures {
 	sigs = &Signatures{
 		signatures: make(map[Key]*Signature, 512),