From a0b7e0ab640ae0248336d7de8cf49c438da2f8b5 Mon Sep 17 00:00:00 2001
From: Red Bear OS <build@redbearos.org>
Date: Tue, 14 Jul 2026 18:55:06 +0900
Subject: [PATCH] fix(spawn): install bootstrap fds in child file table

The copied child table did not reliably retain the thread and process descriptors at the numbers exported through auxv. Explicitly clone both descriptors into the selected child table before loading the image, and remove the ineffective parent-handle leak.
---
 src/platform/redox/mod.rs | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/platform/redox/mod.rs b/src/platform/redox/mod.rs
index ffb629d97f..db2895d701 100644
--- a/src/platform/redox/mod.rs
+++ b/src/platform/redox/mod.rs
@@ -1224,6 +1224,15 @@ impl Pal for Sys {
 
         let new_file_table = child.thr_fd.dup_into_upper(b"filetable-binary")?;
 
+        let child_bootstrap_fds = [child.thr_fd.as_raw_fd(), proc_fd.as_raw_fd()];
+        for fd in child_bootstrap_fds {
+            new_file_table.call_wo(
+                &fd.to_ne_bytes(),
+                syscall::CallFlags::FD | syscall::CallFlags::FD_CLONE,
+                &[fd as u64],
+            )?;
+        }
+
         if let Some(fac) = fac {
             for action in fac {
                 match action {
@@ -1483,13 +1492,6 @@ impl Pal for Sys {
         let start_fd = child.thr_fd.dup_into_upper(b"start")?;
         start_fd.write(&[0])?;
 
-        // The kernel does not keep a self-reference to the new context's thread
-        // fd. If the parent closes its handle before the child reads AT_REDOX_THR_FD
-        // from auxv and creates its own reference, the child thread object is
-        // destroyed and the dynamic linker panics trying to open regs/env. Until
-        // the kernel holds a reference per context, leak the parent handle.
-        let _ = child.thr_fd.take();
-
         Ok(pid_t::try_from(child.pid).unwrap())
     }