Two production-code lie-grade fixes from the Round 9 systematic audit
(local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md and
local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md §10):
1. Mesa redox winsys: redox_drm_fence.{h,c} had a header/implementation
type mismatch. The .h declared
struct pipe_fence_handle *redox_drm_fence_create(...)
but the .c returned uint64_t and passed the scheme fd through pointer
casts ((int)(intptr_t)fence). The pipe_fence_handle struct defined in
the .h was dead code. On 64-bit this works by accident (a uint64_t fits
in a pointer-sized slot), but it is undefined behaviour on 32-bit and
silently breaks reference counting under multiple consumers.
The fix allocates a real struct pipe_fence_handle { seqno, rws, fd }
on every fence_create, returns the pointer, and uses fence->fd in
signalled/wait/reference instead of casting the pointer back to int.
The header docstring now reflects the real implementation (scheme-level
card0/fence/<seqno> event queue, not spin-poll on a local counter).
2. redbear-dnsd: scheme.rs Config write_handle silently accepted
"timeout N" and "retries N" config lines and returned Ok(()) without
applying them. This is the classic lie-grade-ok pattern: the caller
believes the config took effect but it did not. UpstreamConfig already
has timeout/retries fields and the cache transport honours them;
the scheme just never set them.
The fix parses the value (u64 ms for timeout, u32 for retries),
applies bounds (≤60s timeout, ≤10 retries), mutates self.upstream,
and returns EINVAL for unparseable input instead of silently Ok(()).
Duration is now imported alongside Instant.
3 files changed, +43/-29.
vasilito
aae6c36b80