tmpfs_write never re-checks APPEND/IMMUTABLE per write — flags set after open are defeated by pre-existing writable fds (UFS enforces APPEND per-write)

Summary

tmpfs enforces the APPEND flag only at open time and never in tmpfs_write — no tn_flags check anywhere in the write path. vn_writechk only covers VTEXT/EROFS, so nothing else re-checks. UFS re-validates at every write ('if ((ip->i_flags & APPEND) && uio->uio_offset != ip->i_size) return EPERM'). Consequence: a writable fd opened before root sets SF_APPEND/SF_IMMUTABLE (incident-response freezing of a /tmp artifact) keeps writing — pwrite() at an explicit offset overwrites the middle of an append-only tmpfs file, and writes to an immutable-flagged file succeed. Setting these flags requires root, so the bypass matters only against administrator intent (hammer2 shares the gap; UFS is the reference behavior). Untested (needs root to set flags). Fix: add the UFS-exact check to tmpfs_write near the VREG check.

Timeline

• 2026-09-02 Discovered during pass-2 audit of tmpfs_vnops.c (GLM 5.3). DF-0779 re-verified, not re-reported; positive-offset 2^63 wrap refuted live (unsigned size_t promotion — both probe pwrites returned EFBIG).