Reject negative file descriptors before fstat

Return EBADF for negative ordinary descriptors before calling rustix, avoiding debug-build assertions on canonical invalid-fd tests. Keep directory-fd sentinel and absolute-path handling unchanged. Assisted-by: Codex:model-version-unavailable
youknowdot · Oct 2, 2026 · Oct 2, 2026 · Oct 2, 2026 · Oct 2, 2026 · Oct 2, 2026
commit cf01240d50f0bc0cfd737ad2f9855c7a1d199b9b
diff --git a/crates/host_env/src/fileutils.rs b/crates/host_env/src/fileutils.rs
@@ -11,6 +11,10 @@ pub use windows::{StatStruct, fstat};
 
 #[cfg(not(windows))]
 pub fn fstat(fd: crate::crt_fd::Borrowed<'_>) -> std::io::Result<StatStruct> {
+    // Unlike a directory fd, fstat accepts no negative descriptor sentinels.
+    if fd.as_raw() < 0 {
+        return Err(std::io::Error::from_raw_os_error(libc::EBADF));
+    }
     rustix::fs::fstat(fd).map_err(Into::into)
 }