TUN mode: no network / DNS dead — the repair steps

TUN trouble shows up as "flip the switch, lose the internet" or "IPs reachable, domains not". Fix in this order:

1. Confirm Service Mode is installed: the globe on Settings → Service Mode must be green. Without it, TUN can fail to create its adapter with no clear error. Install, restart the app, retry TUN;
2. Confirm DNS hijack: under TUN, Clash must own DNS. The config (or a Mixin override) should contain:

   dns:
     enable: true
     enhanced-mode: fake-ip
     listen: 0.0.0.0:53
   tun:
     enable: true
     stack: system
     dns-hijack:
       - any:53

   The TUN switch normally handles this, but profiles whose dns section was edited by Mixin/Parsers often break here;
3. Try the other stack: toggle stack between system and gvisor — compatibility differs by environment, each wins some;
4. Remove leftover adapters: repeated abnormal toggles can strand multiple Clash adapters. Device Manager → Network adapters: uninstall all Clash virtual adapters, then re-enable TUN;
5. Firewall / AV: some security suites block adapter creation or the port-53 listener — whitelist.

Verification once fixed: in a terminal without proxy variables, nslookup github.com answers and curl ip.gs shows the node IP.