Test case Pdfork.InvalidFlag available in https://github.com/google/capsicum-test
Jon, Siva (one of the Foundation's co-op students for the summer term) will take a look at this.
The test case is passing on HEAD, it seems that the fix went unnoticed. We should be able to close this.
(In reply to Siva Mahadevan from comment #2) I can't see evidence of a fix though, or a test that would return EINVAL for this case: I worry the test is providing insufficient coverage.
(In reply to Ed Maste from comment #3) In terms of a test that would return EINVAL, I think this from sys/kern/kern_fork.c covers it: int fork1(struct thread *td, struct fork_req *fr) { ... if ((flags & RFPROCDESC) != 0) { ... /* Check if we are using supported flags. */ if ((fr->fr_pd_flags & ~PD_ALLOWED_AT_FORK) != 0) return (EINVAL); } ... } flags will contain RFPROCDESC on a pdfork and the following definition exists: #define PD_ALLOWED_AT_FORK (PD_DAEMON | PD_CLOEXEC)
Oh indeed, addressed by Mariusz in r301573, which is in stable/11. As you say this can be closed.