# DF-2836 — sonewconn_faddr() inherits the listener's entire so_state

## What

`sys/kern/uipc_socket2.c:383`:

```c
so->so_state = head->so_state | SS_NOFDREF | SS_ASSERTINPROG;
```

A socket created for an inbound connection inherits **every** state bit of
the listener at birth. A listener that has been `shutdown(SHUT_WR)` carries
`SS_CANTSENDMORE` (and `SHUT_RD` carries `SS_CANTRCVMORE`, `fcntl(F_SETFL,
O_ASYNC` carries `SS_ASYNC`, etc.), so every subsequently accepted socket is
born half-shut / pre-flagged. Upstream FreeBSD fixed this decades ago by
inheriting only the NBIO bit (`so->so_state &= SS_NBIO` in sonewconn);
DragonFly has no `SS_NBIO` in `so_state` (nonblocking lives in `fp->f_flag`),
so the correct DragonFly form is to inherit nothing.

## Impact

Unprivileged local user (or a peer connecting to a service performing a
graceful listener shutdown during restart): `accept()` returns a socket that
is dead-on-arrival in one or both directions (`send()` → EPIPE, `recv()` →
immediate EOF) although the connection is fully live at the transport layer.
Correctness/availability defect, no memory unsafety.

## Reproduce

Unprivileged:

```
cc -O -o stateinherit stateinherit.c
./stateinherit
```

Expected on a correct stack (and on the patched kernel validated in this
pack): `unix: accepted send = 4` — the accepted socket behaves like a fresh
connection.

Observed on the stock kernel: `unix: accepted send = -1 errno=32 [Broken
pipe]` while `accepted recv = 4` proves the connection is live — the child
was born with the listener's `SS_CANTSENDMORE`.

(The TCP variant is masked in this scenario because `shutdown(SHUT_WR)` on a
TCP listener makes tcp refuse new SYNs — "Connection refused" — so the
AF_UNIX listen path is the demonstrable path.)

## Files

* `stateinherit.c` — PoC source
* `run.log`, `run.2.log` — decisive runs (stock kernel)
* `fix_validation.log` — same PoC on the one-fix kernel (DF-2836+DF-2838)
* `fix.diff` — proposed fix (validated in-guest)
* `env.txt` — guest kernel/compiler state