fuzz: reach the poll/ppoll bodies, denial branches, and host fd leaks

[perbu]

Three structural blind spots in the syscall fuzzer. Each one hid a confirmed bug from the week-long campaign — not because the fuzzer was unlucky, but because the code was unreachable or the symptom was invisible.

poll/ppoll bodies were never executed. The sandbox policy installed a poll_callback returning false to stop the handlers blocking on a forked VM. But that callback is consulted before the fd-translation loop, so both handler bodies — the part that parses the guest's pollfd array — never ran at all. This clamps the timeout instead, the same way clock_nanosleep is already handled: poll's is a plain ms argument, ppoll's is a guest pointer to a timespec, and a null one is redirected to a private zeroed timespec kept out of the address table. The bodies now run and still cannot block. This is where the fixed-256-entry array::at() overflow lived (#102).

Denial branches were unreachable. Contrary to what I initially assumed, the path callbacks are installed — but they rewrite every path into the sandbox directory and return true, so no policy denial ever happens. A handler that computes -EPERM and then runs the host call anyway is indistinguishable from a correct one under an always-approve policy, which is exactly #95. TINYKVM_FUZZ_DENY_PATHS=1 refuses everything instead.

Host fd leaks were invisible. They do not crash, and ASan/UBSan do not track fd counts, so an fd the emulation layer opens but never records shows up only as the VMM process slowly running out of descriptors. This counts /proc/self/fd after each input's reset_to() and reports growth past the baseline.

That last check reports on the current tree

fds grow monotonically, roughly linearly with inputs. Worth knowing before anyone turns it up to fatal:

• dup2 (dup2 registers the stale fd instead of the dup() result, leaking a host fd per call #99) is one source, but not the only one — growth persists with dup2 blocked.
• It also happens in deny-paths mode, where no file can be opened at all, so pipe2/socketpair/epoll_create1/dup are worth investigating.

Because of that it reports and re-baselines rather than aborting. TINYKVM_FUZZ_FDLEAK_ABORT=1 makes it fatal and should become the default in syscall_fuzzer.sh once the leaks are closed. Same story for TINYKVM_FUZZ_STRICT, which currently trips over the reachable futex throw (#101) — I did not make it the default for that reason, though the script now documents both.

Env flags now treat an empty value as unset, so a runner can default one on and still let the caller switch it off with VAR= rather than unset VAR.

Verified: both modes complete a 4000-run campaign with no timeouts from the poll wrapper.

🤖 Generated with Claude Code