v3.45.6: masquerade path check (audit fix)