sys_lwp_rtprio() with tid == -1 ignores the target pid and always operates on the caller's own lwp

Summary

tid == -1 ("sadly, tid can be 0 so we can't use 0 here") resolves lp = curthread->td_lwp regardless of uap->pid. RTP_SET/RTP_LOOKUP with pid=, tid=-1 checks credentials against the TARGET process but then reads/writes the CALLER's own lwp. All privilege checks remain on the caller's credential — no security boundary crossed; silently mis-targets the operation (e.g. a root process intending to set another process's first lwp instead modifies its own).

Recommended fix

When pid != 0 and tid == -1, resolve lp from the target (FIRST_LWP_IN_PROC(p) with the DF-2791 NULL check), or reject the combination with EINVAL.

Timeline

• 2026-08-31 Discovered during pass-2 audit of kern_resource.c (GLM 5.3).