Line-accurate confirmation (deviation is deny-only on every reachable
path today, so no userland-visible demo exists):
sys/kern/vfs_helper.c:88-94 vop_helper_access selects cr_ruid/
   cr_rgid (REAL ids) whenever a_flags lacks AT_EACCESS
sys/sys/vfsops.h:1040-1041 the bare 3-arg VOP_ACCESS macro passes
   flags=0 -> kernel-internal authorization callers get REAL-id
   semantics while the primary gate naccess_lva uses EFFECTIVE ids
   (vfs_nlookup.c:1854-1874)
Callers switched to VOP_EACCESS by fix.diff: vfs_syscalls.c:4888
(sys_fhopen, euid-0-gated), kern_fp.c:162 (fp_vpopen, kernel
consumers), tmpfs_vnops.c:180, ext2_lookup.c:484/557/610,
ext2_vnops.c:798 (all behind nlookup's effective-id gate).