What I did

Prevented NeighOrch::enableNeighbors() from inserting a default cache entry while checking whether a bulk-enable neighbor exists.

Root cause

The old code read the map before checking it:

ctx->mac = m_syncdNeighbors[neighborEntry].mac;

if (m_syncdNeighbors.find(neighborEntry) == m_syncdNeighbors.end())
{
    continue;
}

std::map::operator[] inserts a default value when the key is missing. The intended absence check was therefore unreachable:

missing neighbor
    -> operator[] inserts a default entry
    -> find() succeeds
    -> default MAC/state enters the bulk-enable path

The fix uses one non-mutating lookup and reads the MAC only after the entry is confirmed:

auto neighborIt = m_syncdNeighbors.find(neighborEntry);
if (neighborIt == m_syncdNeighbors.end())
{
    continue;
}
ctx->mac = neighborIt->second.mac;

Why I did it

MuxNbrHandler::enable() can hand NeighOrch a context for a neighbor that disappeared from m_syncdNeighbors before bulk processing. A read-side guard must not manufacture the state it is trying to detect.

This defect was found while reviewing PR #4746, but it predates that change and belongs in a separate PR because it affects NeighOrch cache correctness and MUX bulk-enable behavior, not the IntfsOrch removal fence.

The fix has no standalone master merge dependency and remains independently reviewable.

How I verified it

Added EnableNeighborsDoesNotInsertMissingNeighbor in tests/mock_tests/neighorch_ut.cpp.

The regression:

1. creates a bulk context for a neighbor absent from m_syncdNeighbors;
2. verifies the cache is empty;
3. calls enableNeighbors();
4. verifies the intended missing-neighbor no-op succeeds;
5. verifies the cache remains empty.

Current exact-head master PR build

• Head: faa3e6df99028137237ea70c9fa99f5a8b8c097c
• Azure PR build: 1171074
• All architecture, ASAN, Docker, Trixie, Test vstest, and TestAsan vstest lanes passed.
• CodeQL, Semgrep, DCO, EasyCLA, and the exact-head Copilot review are clean.
• No local build was used; validation is PR-build only.

202605 PR-build validation

• Validation-only PR: #4747
• The same operator[]-before-find() defect exists on 202605.
• This PR is included after [neighorch]: Track remote next hops on inband RIF #4769 and before batch-2 PRs [intfsorch]: Retry explicit router interface VRF rehome #4764 and [neighorch]: Retry until inband port is available #4770 in the complete validation stack.
• Exact validation head: d4b0502ecdac76d56fdf063a633045c0fb0de977
• Azure PR build: 1171672 — in progress.
• The Tested for 202605 branch label must remain absent until that exact result is complete.

Details if related

• Changed files:
  • orchagent/neighorch.cpp
  • tests/mock_tests/neighorch_ut.cpp
• Originating review finding: [intfsorch]: Fence new RIF dependencies during interface removal #4746 (comment)
• Merge batch 1. PR [neighorch]: Retry until inband port is available #4770 must be rechecked after this PR merges because both touch NeighOrch removal paths.