test(getcwd): lock in KindNull enter + exit-time cwd resolution

Audit of the getcwd(2) tracing path. getcwd's args[0] is a char *buf
OUTPUT buffer: the kernel writes the absolute cwd path into it and the
contents are only valid AFTER the syscall returns. Reading it at enter
would capture an empty/garbage string, so getcwd is correctly KindNull
at enter and the cwd is resolved at EXIT from /proc/<tid>/cwd when the
return value is positive (handleNullExit). Family FS, docs and drift
tests already aligned; no behavior change required.

Add lock-in tests pinning the correct behavior:
- generate: strengthen TestClassifyNullGetcwd to assert the enter kind
  is never KindPathname/KindName and no pathname field is captured;
  add TestClassifyByFieldGetcwdBufNotPath proving the generic field
  classifier never treats char *buf as a path (defense-in-depth).
- eventloop: add GetcwdFailureEventTest asserting that a failed getcwd
  (negative errno, e.g. -ERANGE) attaches no cwd path, and document the
  output-buffer nuance in the success-case test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 31 insertions, 0 deletions

diff --git a/internal/eventloop_test.go b/internal/eventloop_test.go
index 98d7696..3d256be 100644
--- a/internal/eventloop_test.go
+++ b/internal/eventloop_test.go
@@ -66,6 +66,7 @@ func TestEventloop(t *testing.T) {
 		// NullEvent tests
 		"SyncEventTest":            makeSyncEventTestData(t),
 		"GetcwdEventTest":          makeGetcwdEventTestData(t),
+		"GetcwdFailureEventTest":   makeGetcwdFailureEventTestData(t),
 		"IoUringSetupEventTest":    makeIoUringSetupEventTestData(t),
 		"IoUringSetupFailureTest":  makeIoUringSetupFailureTestData(t),
 		"IoUringEnterEventTest":    makeIoUringEnterEventTestData(t),
@@ -1589,6 +1590,9 @@ func makeGetcwdEventTestData(t *testing.T) (td testData) {
 		if !exitEv.Equals(ep.ExitEv) {
 			t.Errorf("Expected '%v' but got '%v'", exitEv, ep.ExitEv)
 		}
+		// getcwd args[0] (buf) is an OUTPUT buffer that is only valid at exit,
+		// so the path is never read at enter. Instead it is resolved at exit
+		// from /proc/<tid>/cwd, which must equal the process cwd here.
 		if ep.File == nil {
 			t.Fatalf("Expected getcwd to attach a pathname")
 		}
@@ -1600,6 +1604,33 @@ func makeGetcwdEventTestData(t *testing.T) (td testData) {
 	return td
 }
 
+// makeGetcwdFailureEventTestData locks in that a failed getcwd (negative
+// errno return) does NOT resolve or attach a cwd path. The exit handler only
+// reads /proc/<tid>/cwd when ret > 0 (success returns the path length); on
+// error there is nothing to attach.
+func makeGetcwdFailureEventTestData(t *testing.T) (td testData) {
+	enterEv, enterEvBytes := makeEnterNullEvent(t, defaulTime, defaultPid, defaultTid, types.SYS_ENTER_GETCWD)
+	td.rawTracepoints = append(td.rawTracepoints, enterEvBytes)
+
+	// ERANGE: buffer too small. Raw syscall reports it as a negative errno.
+	exitEv, exitEvBytes := makeExitRetEvent(t, defaulTime+100, defaultPid, defaultTid, types.SYS_EXIT_GETCWD, -int64(syscall.ERANGE))
+	td.rawTracepoints = append(td.rawTracepoints, exitEvBytes)
+
+	td.validates = append(td.validates, func(t *testing.T, _ *eventLoop, ep *event.Pair) {
+		if !enterEv.Equals(ep.EnterEv) {
+			t.Errorf("Expected '%v' but got '%v'", enterEv, ep.EnterEv)
+		}
+		if !exitEv.Equals(ep.ExitEv) {
+			t.Errorf("Expected '%v' but got '%v'", exitEv, ep.ExitEv)
+		}
+		if ep.File != nil {
+			t.Errorf("Expected no cwd attached on getcwd failure, got '%v'", ep.File.Name())
+		}
+	})
+
+	return td
+}
+
 func makeIoUringSetupEventTestData(t *testing.T) (td testData) {
 	enterEv, enterEvBytes := makeEnterNullEvent(t, defaulTime, defaultPid, defaultTid, types.SYS_ENTER_IO_URING_SETUP)
 	td.rawTracepoints = append(td.rawTracepoints, enterEvBytes)