From bfb5f8b2ca7baf9c6257196b99a2be69ef276e59 Mon Sep 17 00:00:00 2001
From: vasilito <adminpupkin@gmail.com>
Date: Mon, 27 Jul 2026 16:09:41 +0900
Subject: [PATCH] libredox: replace demux() .expect() with .unwrap_or(u16::MAX)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CRITICAL F3.1 from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.4: demux() panicked on edge-case errno via '.expect("2^BITS - res < 4096")'.
Called from every syscall wrapper (~40 call sites). A kernel returning
errno outside the 0..=4095 range would panic the entire process.

Fix: saturate to u16::MAX on overflow rather than panic. The errno
field is u16; values above u16::MAX indicate a kernel ABI violation,
and surfacing u16::MAX is safer than crashing every caller.

Trivial change (one line: .expect -> .unwrap_or(u16::MAX)) with a
comment explaining the saturate-vs-panic tradeoff.
---
 src/lib.rs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/lib.rs b/src/lib.rs
index fcf4dc72e9..e0b097d8c0 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -40,7 +40,12 @@ pub mod error {
         pub fn demux(res: usize) -> Result<usize, Self> {
             if res > usize::wrapping_neg(4096) {
                 Err(Self {
-                    errno: res.wrapping_neg().try_into().expect("2^BITS - res < 4096"),
+                    // Saturate to u16::MAX on overflow rather than panic; the
+                    // demux ABI returns the errno in the low 16 bits of a usize,
+                    // and `wrapping_neg(4096)` is the boundary. Values above
+                    // u16::MAX indicate a kernel ABI violation; surfacing
+                    // u16::MAX is safer than panicking every syscall wrapper.
+                    errno: res.wrapping_neg().try_into().unwrap_or(u16::MAX),
                 })
             } else {
                 Ok(res)