Selector arm: the address the socket actually dialsSplit-flap board: the attacker's DNS answer, TTL 0The clearance station checks lookup 1 (8.8.8.8) and its lamp clears. The selector then reads the board again at connect time, gets 127.0.0.1, and dials the internal service. With the fix, as in 2.5.1, the checked address rides with the request and the selector dials that.