Thanks for the careful review and the pointers. I dug deeper and found the root cause on my side: there was leftover/out-of-tree code in my local tree that could attach the per-rule template to skb->_nfct. After cleaning up those remnants, upstream behavior matches your description— nf_conntrack_in() clears any template, tftp_help() sees a real conntrack, and I can no longer reproduce the crash. Apologies for the noise and for any time this cost you. I’ll withdraw the patch as it was addressing a problem introduced by my local changes. Thanks again for the guidance.
