diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java
index d744d34..94bc44b 100644
--- a/services/core/java/com/android/server/ConnectivityService.java
+++ b/services/core/java/com/android/server/ConnectivityService.java
@@ -746,7 +746,7 @@
                         + Arrays.toString(vpnNai.declaredUnderlyingNetworks));
                 return;
             }
-            final NetworkAgentInfo underlyingNai =  mService.getNetworkAgentInfoForNetwork(
+            final NetworkAgentInfo underlyingNai = mService.getNetworkAgentInfoForNetwork(
                     vpnNai.declaredUnderlyingNetworks[0]);
             if (underlyingNai == null) return;
 
@@ -4824,12 +4824,15 @@
         if (!mLockdownEnabled) {
             return null;
         }
-        // The legacy lockdown VPN always only applies to UID 0.
+        // The legacy lockdown VPN always only applies to userId 0.
         final NetworkAgentInfo nai = getVpnForUid(Process.FIRST_APPLICATION_UID);
         if (nai == null || !isLegacyLockdownNai(nai)) return null;
 
         // The legacy lockdown VPN must always have exactly one underlying network.
-        if (nai.declaredUnderlyingNetworks == null ||  nai.declaredUnderlyingNetworks.length != 1) {
+        // This code may run on any thread and declaredUnderlyingNetworks may change, so store it in
+        // a local variable. There is no need to make a copy because its contents cannot change.
+        final Network[] underlying = nai.declaredUnderlyingNetworks;
+        if (underlying == null ||  underlying.length != 1) {
             return null;
         }
 
@@ -4839,8 +4842,7 @@
         // Report that the VPN is not connected, so when the state of NetworkInfo objects
         // overwritten by getLegacyLockdownState will be set to CONNECTING and not CONNECTED.
         final NetworkAgentInfo defaultNetwork = getDefaultNetwork();
-        if (defaultNetwork == null
-                || !defaultNetwork.network.equals(nai.declaredUnderlyingNetworks[0])) {
+        if (defaultNetwork == null || !defaultNetwork.network.equals(underlying[0])) {
             return null;
         }
 
@@ -4899,6 +4901,9 @@
     private BroadcastReceiver mIntentReceiver = new BroadcastReceiver() {
         @Override
         public void onReceive(Context context, Intent intent) {
+            // TODO: make BroadcastInterceptingContext use the Handler passed in to registerReceiver
+            // and put this back.
+            // ensureRunningOnConnectivityServiceThread();
             final String action = intent.getAction();
             final int userId = intent.getIntExtra(Intent.EXTRA_USER_HANDLE, UserHandle.USER_NULL);