aarch64 prod gate: TTY_ORACLE cloexec_exec fcntl_setfd_failed EAGAIN (1 in 10 on main bdb5be90 A/B arm)

[ryanbreen]

Signature

[TTY_ORACLE:FAIL:cloexec_exec:fcntl_setfd_failed:EAGAIN]
FAIL: TTY oracle reported failure: [TTY_ORACLE:FAIL:cloexec_exec:fcntl_setfd_failed:EAGAIN]

Seen on origin/main at bdb5be90 (merge of PR #795, "fix/ttbr0-shadow-reconciliation"),
production-profile aarch64 gate, during today's #690 A/B run.

Where

• Serial: docs/planning/green-program/aarch64-testing/serials/slice1/ab-690/main/boot-3-serial.txt
• Gate transcript: docs/planning/green-program/aarch64-testing/serials/slice1/ab-690/main/boot-3-gate.txt

Both are in-repo on origin/main as of bdb5be90.

STEP-1 reading

arm_cloexec_exec() in userspace/programs/src/tty_oracle.rs (arm 14 of 14) opens a
fresh PTY pair, calls fcntl(slave, F_SETFD, FD_CLOEXEC) via
libbreenix::io::fcntl_setfd, then forks and execs a marker copy of itself to prove
close_cloexec() retires the child's fork-cloned slave fd during exec(). The failing
line is the very first step: the fcntl(F_SETFD) call itself returned EAGAIN before
the fork/exec ever ran.

On the kernel side, sys_fcntl (kernel/src/syscall/handlers.rs:3858) resolves the
current process by first acquiring the process-manager lock via
crate::process::try_manager() (a try-lock). If that try-lock fails to acquire, the
handler returns SyscallResult::Err(11) -- errno EAGAIN -- before ever reaching the
F_SETFD dispatch arm. The actual F_SETFD implementation,
FileDescriptorTable::set_fd_flags (kernel/src/ipc/fd.rs:630), can only fail with
EBADF (bad fd) -- it has no EAGAIN return path of its own. So this EAGAIN did not
come from the fd-flags logic; it came from try_manager() finding the process-manager
lock contended at the moment tty_oracle issued its fcntl syscall, i.e. a transient
lock-contention failure in the fcntl syscall's process-lookup path, not a cloexec/PTY
defect.

Separately: bsshd reached "listening" in this same boot (serial.txt:389,
bsshd: listening on 0.0.0.0:2222), after tty_oracle had already exited(1) at
serial.txt:325. The gate's own transcript (boot-3-gate.txt) reports
FAIL: TTY oracle reported failure and EXIT_CODE=1 despite that later bsshd-listening
line, consistent with the gate's TTY-oracle check running (and failing) before its
bsshd check is reached.

Rate context

• 1/10 boots in the #690 A/B main arm (this boot, boot-3 of 10).
• 0/10 boots in the #690 A/B slice-1 branch arm.
• Not seen in the slice-1 prove run (3/3 clean).

Attribution

This is a main red (not attributable to the slice-1 branch under test) and, per
R157, requires attribution rather than being folded silently into the slice-1 A/B
verdict.

[ryanbreen]

PR #819 merged to main at be412ee93ace07be0a62f85c4dd8b4d1e8338298.

The merge:

• Repairs sys_fcntl's process-lookup preamble (kernel/src/syscall/handlers.rs)
  and both architecture bodies of sys_sigsuspend (kernel/src/syscall/signal.rs)
  to take the blocking crate::process::manager() instead of turning a failed
  try_manager() try-lock into an EAGAIN returned to userspace -- the same
  discipline sys_dup/sys_dup2 already followed in the same file.
• Adds a FCNTL_PM_CONTENTION_ORACLE that forces the contention deterministically
  and wires it into both aarch64 boot gates (the strict gate's score_serial
  requires its PASS pattern; the production gate asserts the marker's absence);
  the x86 gates carry a disclosed SKIP since they boot -smp 1 and have no
  second thread to contend for the lock.
• Files aarch64: NetRx softirq at IRQ exit can block on PROCESS_MANAGER under a try_manager() holder in a preempt-disabled syscall (self-deadlock window) #812 (a NetRx softirq bottom half can still block on
  PROCESS_MANAGER on aarch64) and POSIX-illegal EAGAIN on blocking fds: pipe write, FIFO write, unix-socket write, /dev/console|tty read (same class as #796, outside its census scope) #813 (four other sites return EAGAIN on
  blocking file descriptors, a different mechanism) rather than fixing either
  in this scope.

Landing re-smoke at the merged head (after picking up PR #818's gate
verdict-discipline widening): 31 of 31 tests/*_structure.rs suites green
(567 cases), scripts/test_claim_lint.py exit 0, and PASS on the aarch64
strict, aarch64 production, x86 boot-tests and x86 production gates. Full
detail: docs/planning/green-program/syscalls/796-FCNTL-EAGAIN-2026-09-05.md.

[ryanbreen]

Repaired and merged in PR #819 (be412ee).