CRITICAL F002 from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.1: worker_pool::OwnedFd::from_raw_fd accepted 'raw: usize' and
called libc::dup(raw as i32) on it. A garbage 64-bit value that
happens to cast to a valid i32 fd would clone whatever file was at
that fd number — a confused-deputy vulnerability in a sandboxed
microkernel.
Fix: change the parameter type to std::os::fd::RawFd (the platform
c_int). A garbage 64-bit value cannot be cast to a valid i32 fd
anymore; the value can only have come from a previously-validated
fd (via IntoRawFd::into_raw_fd, libredox::Fd::raw, or a similar
source that went through the kernel's open-fd table).
Callers in scheme/mod.rs use 'File::from_raw_fd(nf.into_raw() as
RawFd)', so the cast site moves from inside from_raw_fd to the
caller (where the value is known to be a real fd at that point).
The function-level unsafe invariant is now stronger: 'the parameter
is a RawFd that came from a real fd' rather than 'the parameter is
any integer that might be a real fd'.
Red Bear OS
b19e0a6464