From e3f87fa3cf9a044e17d4167db23da68366f91f28 Mon Sep 17 00:00:00 2001
From: Red Bear OS <build@redbearos.org>
Date: Mon, 27 Jul 2026 16:47:49 +0900
Subject: [PATCH] netstack: fix F003 scheme File ownership redundant cast
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CRITICAL F003 from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.1: netstack/src/scheme/mod.rs had 2 unsafe File::from_raw_fd sites
with redundant 'as RawFd' casts. The audit flagged these as:
- 'The cast chain nf.into_raw() as RawFd goes through i32 → u32 → i32
  via RawFd, which is a truncation on some platforms'
- The SAFETY comments were generic boilerplate ('caller must verify
  the safety contract') rather than documenting the actual invariant

Fix: remove the redundant 'as RawFd' cast — File::from_raw_fd
already accepts the RawFd type that IntoRawFd::into_raw returns.
Also replace the generic boilerplate SAFETY comments with specific
invariants:
- 'caller guarantees nf is a live Fd not aliased elsewhere;
  from_raw_fd transfers ownership to the new File'
- 'caller guarantees time_file is a live Fd not aliased elsewhere;
  from_raw_fd transfers ownership to the new File'

The 'as RawFd' cast was a no-op on platforms where RawFd = i32, but
was still misleading (suggests a conversion is happening when it
isn't). Removing it clarifies the code.

CRITICAL progress: 13 of 13 original findings now addressed (F001,
F1.6, F1.1, F2, F3, DEF-P0-6, DEF-P0-7, F18/F18b, F20, F21, F3.1,
F22, P001).
---
 netstack/src/scheme/mod.rs | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/netstack/src/scheme/mod.rs b/netstack/src/scheme/mod.rs
index 18e2cc2a8e..8b0a6a141a 100644
--- a/netstack/src/scheme/mod.rs
+++ b/netstack/src/scheme/mod.rs
@@ -178,9 +178,11 @@ impl Smolnetd {
             } else {
                 name
             };
-            let mut link = EthernetLink::new(&dev_name, // SAFETY: caller must verify the safety contract for this operation
-unsafe {
-                File::from_raw_fd(nf.into_raw() as RawFd)
+            let mut link = EthernetLink::new(&dev_name, // SAFETY: caller guarantees nf is a live Fd not aliased
+                                       // elsewhere; from_raw_fd transfers ownership
+                                       // to the new File.
+            unsafe {
+                File::from_raw_fd(nf.into_raw())
             });
             link.set_mac_address(hw_addr);
             devices.borrow_mut().push(link);
@@ -191,8 +193,10 @@ unsafe {
             router_device: network_device,
             socket_set: Rc::clone(&socket_set),
             timer: ::std::time::Instant::now(),
-            time_file: // SAFETY: caller guarantees fd is valid, open, and not aliased
-unsafe { File::from_raw_fd(time_file.into_raw() as RawFd) },
+            time_file: // SAFETY: caller guarantees time_file is a live Fd not
+                     // aliased elsewhere; from_raw_fd transfers ownership
+                     // to the new File.
+            unsafe { File::from_raw_fd(time_file.into_raw()) },
             ip_scheme: IpScheme::new(
                 "ip",
                 Rc::clone(&iface),