test: add coverage for setitimer (signal-safe) and statfs/fstatfs

setitimer/getitimer (di0): no scenario previously exercised the classic
interval-timer family. Add intervalTimerNoop, which calls
setitimer(ITIMER_REAL, &{0,0,0,0}, NULL) with an all-zero itimerval so the
timer is disarmed and NO SIGALRM is ever scheduled (mirrors miscAlarmCancel's
alarm(0) and posixTimerLifecycle's never-firing pattern), followed by a safe
getitimer read. Both are KindNull on enter / UNCLASSIFIED on exit, so
TestIntervalTimerNoop asserts enter_setitimer and enter_getitimer presence.

statfs/fstatfs (7j0): stat_test.go covered stat/fstat/lstat/newfstatat/statx
but not the statfs family. Add statStatfs, which calls syscall.Statfs(path)
(enter_statfs path_event captures the pathname) and syscall.Fstatfs(fd)
(enter_fstatfs fd_event). TestStatStatfs asserts enter_statfs PathContains the
filename and enter_fstatfs presence. Covers audits it (fstatfs) and e00 (statfs).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2 files changed, 48 insertions, 0 deletions

diff --git a/integrationtests/stat_test.go b/integrationtests/stat_test.go
index 400e61a..e803b9f 100644
--- a/integrationtests/stat_test.go
+++ b/integrationtests/stat_test.go
@@ -101,6 +101,25 @@ func TestStatAccessEnoent(t *testing.T) {
 	})
 }
 
+// TestStatStatfs verifies the statfs family (statfs/fstatfs) is traced
+// end-to-end. enter_statfs is a path_event, so its record must contain the
+// file's path; enter_fstatfs is an fd_event, asserted via enter-presence.
+func TestStatStatfs(t *testing.T) {
+	runScenario(t, "stat-statfs", []ExpectedEvent{
+		{
+			PathContains: "statfsfile.txt",
+			Tracepoint:   "enter_statfs",
+			Comm:         "ioworkload",
+			MinCount:     1,
+		},
+		{
+			Tracepoint: "enter_fstatfs",
+			Comm:       "ioworkload",
+			MinCount:   1,
+		},
+	})
+}
+
 func TestStatFstatEbadf(t *testing.T) {
 	runScenario(t, "stat-fstat-ebadf", []ExpectedEvent{
 		{
diff --git a/integrationtests/timer_test.go b/integrationtests/timer_test.go
index 7d9b295..10f54e9 100644
--- a/integrationtests/timer_test.go
+++ b/integrationtests/timer_test.go
@@ -12,6 +12,15 @@ var posixTimerTraceArgs = []string{
 	"timer_create,timer_settime,timer_gettime,timer_getoverrun,timer_delete,timerfd_create",
 }
 
+// intervalTimerTraceArgs restricts tracing to the classic interval-timer
+// syscalls setitimer/getitimer, which the interval-timer-noop workload issues.
+// Both are KindNull (null_event) on enter with an UNCLASSIFIED ret on exit, so
+// the test asserts only enter-presence (no path/fd/return to inspect).
+var intervalTimerTraceArgs = []string{
+	"-trace-syscalls",
+	"setitimer,getitimer",
+}
+
 // TestPosixTimerLifecycle verifies the POSIX per-process timer family is traced
 // end-to-end. The workload runs timer_create -> timer_settime -> timer_gettime
 // -> timer_getoverrun -> timer_delete; each must appear as an enter event.
@@ -41,3 +50,23 @@ func TestPosixTimerLifecycle(t *testing.T) {
 			"timer_create returns a timer_t, not an fd, and must not be classified like timerfd_create", got)
 	}
 }
+
+// TestIntervalTimerNoop verifies the classic interval-timer family (setitimer /
+// getitimer) is traced end-to-end. The interval-timer-noop workload issues a
+// setitimer(ITIMER_REAL, &{0,0,0,0}, NULL) — an all-zero itimerval that arms
+// nothing, so NO SIGALRM is ever scheduled — followed by a getitimer read.
+// Both are KindNull on enter, so we assert enter-presence for each.
+func TestIntervalTimerNoop(t *testing.T) {
+	h := newTestHarness(t)
+	result, pid, err := h.RunWithIorArgs("interval-timer-noop", defaultDuration, intervalTimerTraceArgs)
+	if err != nil {
+		t.Fatalf("run scenario interval-timer-noop: %v", err)
+	}
+
+	AssertNoUnexpectedPID(t, result, pid)
+	AssertNoUnexpectedComm(t, result, "ioworkload")
+	AssertEventsPresent(t, result, []ExpectedEvent{
+		{Tracepoint: "enter_setitimer", Comm: "ioworkload", MinCount: 1},
+		{Tracepoint: "enter_getitimer", Comm: "ioworkload", MinCount: 1},
+	})
+}