startLanMode() took the caller's IP, read before the route lock. A Wi-Fi/Ethernet switch in between left WebConfig locked to the new link while advertising the old link's address. It now reads the selected link's address after lockSwitching(), as startOTAUpdate() already does.