O_CLOEXEC was defined in both libredox (0x0100_0000) and syscall
(0x0100_0000). Per the Single Source of Truth principle (and the
Local Fork Supremacy Policy: 'never version-string-duplicate a
Cat 2 fork crate'), a primitive constant should be defined once
in the most-primitive crate that has it (syscall) and re-exported
by higher-level crates (libredox).
Change: libredox::flag::O_CLOEXEC is now
'syscall::flag::O_CLOEXEC' instead of a literal 0x0100_0000. The
F_DUPFD_CLOEXEC constant stays as a literal since syscall does not
define it (it's a Linux-specific fcntl flag that Redox may not need).
POSIX ftruncate(2) and futimens(2) do not close the file descriptor.
The previous 'self' (by-value) signature consumed the Fd on call, which
would trigger Fd::drop and close the fd as a side effect. After a
successful ftruncate the user could no longer use the fd, which is
the opposite of the intended semantics.
Change to '&self' to match the surrounding methods (fsync, fdatasync
both already use &self) and to match POSIX behaviour. The drop-on-
failure semantics is preserved by Rust's normal borrow checker: if
ftruncate returns Err, the caller's borrow is still valid and the
fd stays open.
CRITICAL F3.1 from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.4: demux() panicked on edge-case errno via '.expect("2^BITS - res < 4096")'.
Called from every syscall wrapper (~40 call sites). A kernel returning
errno outside the 0..=4095 range would panic the entire process.
Fix: saturate to u16::MAX on overflow rather than panic. The errno
field is u16; values above u16::MAX indicate a kernel ABI violation,
and surfacing u16::MAX is safer than crashing every caller.
Trivial change (one line: .expect -> .unwrap_or(u16::MAX)) with a
comment explaining the saturate-vs-panic tradeoff.
Adds 45 minimal SAFETY: comments above unsafe blocks in lib.rs:
- demux(): caller guarantees errno fits in u16 (handled with unwrap_or)
- Fd::Drop munmap: caller guarantees fd is still valid at drop time
- SocketCall enum: caller validates discriminator
- from_raw_fd: caller guarantees fd is valid, open, not aliased
- copy_nonoverlapping: caller guarantees non-overlapping regions
- generic catch-all: caller must verify the safety contract
Part of the systematic fix for ZERO # Safety docs across libredox
(NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md §3.4,
Finding 9.2).
vasilito
Ibuki Omatsu