test: add coverage for setitimer (signal-safe) and statfs/fstatfs

setitimer/getitimer (di0): no scenario previously exercised the classic
interval-timer family. Add intervalTimerNoop, which calls
setitimer(ITIMER_REAL, &{0,0,0,0}, NULL) with an all-zero itimerval so the
timer is disarmed and NO SIGALRM is ever scheduled (mirrors miscAlarmCancel's
alarm(0) and posixTimerLifecycle's never-firing pattern), followed by a safe
getitimer read. Both are KindNull on enter / UNCLASSIFIED on exit, so
TestIntervalTimerNoop asserts enter_setitimer and enter_getitimer presence.

statfs/fstatfs (7j0): stat_test.go covered stat/fstat/lstat/newfstatat/statx
but not the statfs family. Add statStatfs, which calls syscall.Statfs(path)
(enter_statfs path_event captures the pathname) and syscall.Fstatfs(fd)
(enter_fstatfs fd_event). TestStatStatfs asserts enter_statfs PathContains the
filename and enter_fstatfs presence. Covers audits it (fstatfs) and e00 (statfs).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

3 files changed, 92 insertions, 0 deletions

diff --git a/cmd/ioworkload/scenario_stat.go b/cmd/ioworkload/scenario_stat.go
index 5d242c7..7e0c0eb 100644
--- a/cmd/ioworkload/scenario_stat.go
+++ b/cmd/ioworkload/scenario_stat.go
@@ -267,6 +267,43 @@ func statAccessEnoent() error {
 	return nil
 }
 
+// statStatfs creates a file and queries its filesystem via statfs(2) (path
+// input) and fstatfs(2) (fd input) using Go's syscall wrappers, which map
+// directly to SYS_STATFS / SYS_FSTATFS.
+//
+//   - enter_statfs is a path_event: it captures the pathname at arg0, so the
+//     trace records carry the file's path.
+//   - enter_fstatfs is an fd_event: it captures the fd at arg0; ior resolves the
+//     path through its fd lookup table. Its exit is an UNCLASSIFIED ret_event.
+func statStatfs() error {
+	dir, cleanup, err := makeTempDir("stat-statfs")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "statfsfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	// statfs(path, &buf): the pathname is read on entry (enter_statfs).
+	var sbuf syscall.Statfs_t
+	if err := syscall.Statfs(path, &sbuf); err != nil {
+		return fmt.Errorf("statfs: %w", err)
+	}
+
+	// fstatfs(fd, &buf): the fd is read on entry (enter_fstatfs).
+	var fbuf syscall.Statfs_t
+	if err := syscall.Fstatfs(fd, &fbuf); err != nil {
+		return fmt.Errorf("fstatfs: %w", err)
+	}
+
+	return nil
+}
+
 // statFstatEbadf calls raw SYS_FSTAT on an invalid fd (99999).
 // The syscall fails with EBADF, but ior captures the enter_newfstat
 // tracepoint because it is recorded on syscall entry.
diff --git a/cmd/ioworkload/scenario_timer.go b/cmd/ioworkload/scenario_timer.go
index 0bf628d..923c004 100644
--- a/cmd/ioworkload/scenario_timer.go
+++ b/cmd/ioworkload/scenario_timer.go
@@ -15,6 +15,59 @@ type itimerspec struct {
 	Value    unix.Timespec
 }
 
+// itimerval mirrors struct itimerval from <sys/time.h> (it_interval, it_value),
+// each a struct timeval. It is the argument to setitimer/getitimer (the classic
+// interval timers, distinct from the POSIX per-process timer_* family above).
+type itimerval struct {
+	Interval unix.Timeval
+	Value    unix.Timeval
+}
+
+// itimerReal is ITIMER_REAL (=0): a real-time interval timer that, when armed,
+// delivers SIGALRM on expiry.
+const itimerReal = 0
+
+// intervalTimerNoop exercises the classic interval-timer syscalls setitimer(2)
+// and getitimer(2) without ever arming anything, so the enter_setitimer /
+// enter_getitimer tracepoints fire end-to-end while remaining fully SIGNAL-SAFE.
+//
+// SAFETY: setitimer is called with an ALL-ZERO struct itimerval. A zero it_value
+// disarms the timer and arms nothing new, so NO SIGALRM is ever scheduled or
+// delivered — this mirrors the alarm(0) pattern in miscAlarmCancel and the
+// far-future / never-firing approach in posixTimerLifecycle. getitimer is a pure
+// read of the (now disarmed) timer's state.
+//
+// Both setitimer and getitimer are KindNull (null_event) on enter and return an
+// UNCLASSIFIED ret_event on exit: neither takes a pathname nor an fd, and the
+// return value is not a descriptor. We therefore only assert enter-presence.
+func intervalTimerNoop() error {
+	// All-zero itimerval: it_interval = it_value = {0,0}. This disarms
+	// ITIMER_REAL and arms nothing, so no SIGALRM can fire.
+	var zero itimerval
+	if _, _, errno := syscall.RawSyscall(
+		unix.SYS_SETITIMER,
+		itimerReal,
+		uintptr(unsafe.Pointer(&zero)),
+		0, // old_value == NULL (we don't care about the previous setting)
+	); errno != 0 {
+		return fmt.Errorf("setitimer: %w", errno)
+	}
+
+	// getitimer reads the current (disarmed) ITIMER_REAL state into out; a safe,
+	// side-effect-free read included for symmetry with setitimer.
+	var out itimerval
+	if _, _, errno := syscall.RawSyscall(
+		unix.SYS_GETITIMER,
+		itimerReal,
+		uintptr(unsafe.Pointer(&out)),
+		0,
+	); errno != 0 {
+		return fmt.Errorf("getitimer: %w", errno)
+	}
+
+	return nil
+}
+
 // posixTimerLifecycle exercises the full POSIX per-process timer family so the
 // tracer's null_event handling is covered end-to-end:
 //
diff --git a/cmd/ioworkload/scenarios.go b/cmd/ioworkload/scenarios.go
index 869c9ec..2eb18aa 100644
--- a/cmd/ioworkload/scenarios.go
+++ b/cmd/ioworkload/scenarios.go
@@ -52,6 +52,7 @@ var scenarios = map[string]func() error{
 	"polling-epoll":                 pollingEpoll,
 	"sleep-syscalls":                sleepSyscalls,
 	"posix-timer-lifecycle":         posixTimerLifecycle,
+	"interval-timer-noop":           intervalTimerNoop,
 	"process-exec-lifecycle":        processExecLifecycle,
 	"family-mixed":                  familyMixed,
 	"close-basic":                   closeBasic,
@@ -107,6 +108,7 @@ var scenarios = map[string]func() error{
 	"stat-enoent":                   statEnoent,
 	"stat-access-enoent":            statAccessEnoent,
 	"stat-fstat-ebadf":              statFstatEbadf,
+	"stat-statfs":                   statStatfs,
 	"xattr-getxattrat":              xattrGetxattrat,
 	"xattr-listxattrat":             xattrListxattrat,
 	"xattr-removexattrat":           xattrRemovexattrat,