That error was more annoying to find the fix for - caused by fresh pulling in v9 not 7.x
I think the easiest fix there is updating the cache header vtc to have a b2 cond 2 and a barrier b2 sync after the txresp and again at the end of the file to ensure the s1 stop isn't called too soon. That way there should be no race condition that calls stop while somethings still in the process queue.

(Or pin to 7.x I suppose is an option)

@toonvd @peterjaap Any chance you can review this and #127 ? Thanks!

Should be solved at offload or webserver level imho. Magento (and a lot of hostings) use Varnish for caching, not for security.

I don't know anyone who uses varnish as their security layer to be fair, but its the swiss cheese model/defensive posturing. Not everyone who uses this will have something in front, or something in-between (that strips them) to handle this, its just a small addition to ensure this VCL isnt one of those holes.