test(generate): lock in mkdirat path capture at args[1]

Audit of mkdirat(2) found the tracing implementation correct: the generated
BPF handler reads the pathname from args[1] (after the dirfd at args[0]),
while the sibling mkdir(2) reads from args[0] (no dirfd). Both are
KindPathname / FamilyFS with an UNCLASSIFIED return, consistent with
mknod/mknodat and docs/syscall-tracing-plan.md. The arg index is data-driven
from the kernel format via FieldNumber, so no source change was needed.

Add lock-in unit tests and real-format fixtures asserting:
- mkdirat captures the path from args[1], NOT args[0] (negative guard)
- mkdir captures the path from args[0]
- mkdirat/mkdir/mknodat share FamilyFS and KindPathname
- FieldNumber(pathname) = 1 for mkdirat, 0 for mkdir

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 60 insertions, 0 deletions

diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index 880d67d..cd34c63 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -594,6 +594,66 @@ func TestGenerateMqOpenHandler(t *testing.T) {
 	requireContains(t, output, "ev->flags = ctx->args[1];")
 }
 
+// TestGenerateMkdiratHandlerCapturesPathFromArgs1 locks in that mkdirat(2) is a
+// KindPathname event whose path is read from args[1]. mkdirat(dirfd, pathname,
+// mode) places the dirfd at args[0] and the real filesystem path at args[1];
+// reading args[0] would capture the dir fd (often AT_FDCWD) instead of the path.
+// The arg index is data-driven from the kernel format (FieldNumber of the
+// "pathname" field), so this guards against a regression in that derivation.
+func TestGenerateMkdiratHandlerCapturesPathFromArgs1(t *testing.T) {
+	output := generateFromPair(t, FormatMkdirat, FormatExitMkdirat)
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_mkdirat")`)
+	requireContains(t, output, "struct path_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_PATH_EVENT;")
+	requireContains(t, output, "ev->trace_id = SYS_ENTER_MKDIRAT;")
+	requireContains(t, output, "bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]);")
+	// Negative guard: the path must NOT be read from args[0] (the dirfd).
+	requireNotContains(t, output, "bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);")
+	// Return value is a 0/-1 status code, not a byte count: UNCLASSIFIED.
+	requireContains(t, output, "ev->trace_id = SYS_EXIT_MKDIRAT;")
+	requireContains(t, output, "ev->ret_type = UNCLASSIFIED;")
+}
+
+// TestGenerateMkdirHandlerCapturesPathFromArgs0 locks in that the sibling
+// mkdir(2) — which has no dirfd — reads its pathname from args[0]. Contrasting
+// it with mkdirat above ensures the two never collapse onto a shared arg index.
+func TestGenerateMkdirHandlerCapturesPathFromArgs0(t *testing.T) {
+	output := generateFromPair(t, FormatMkdir, FormatExitMkdir)
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_mkdir")`)
+	requireContains(t, output, "struct path_event *ev")
+	requireContains(t, output, "ev->trace_id = SYS_ENTER_MKDIR;")
+	requireContains(t, output, "bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);")
+	requireContains(t, output, "ev->trace_id = SYS_EXIT_MKDIR;")
+	requireContains(t, output, "ev->ret_type = UNCLASSIFIED;")
+}
+
+// TestMkdiratFamilyAndKindMatchSiblings locks in that mkdirat and its siblings
+// mkdir/mknodat share the same FS family and pathname kind classification. A
+// drift here (e.g. mkdirat slipping into Misc) would split related directory/
+// node-creation syscalls across families in the dashboard.
+func TestMkdiratFamilyAndKindMatchSiblings(t *testing.T) {
+	for _, syscall := range []string{"mkdirat", "mkdir", "mknodat"} {
+		if got := ClassifySyscallFamily("sys_enter_" + syscall); got != FamilyFS {
+			t.Errorf("%s family = %q, want %q", syscall, got, FamilyFS)
+		}
+	}
+
+	mkdirat := mustParseOne(t, FormatMkdirat)
+	if r := ClassifyFormat(&mkdirat); r.Kind != KindPathname || r.PathnameField != "pathname" {
+		t.Errorf("mkdirat classified as kind=%d field=%q, want KindPathname/pathname", r.Kind, r.PathnameField)
+	}
+	if n := mkdirat.FieldNumber("pathname"); n != 1 {
+		t.Errorf("mkdirat FieldNumber(pathname) = %d, want 1", n)
+	}
+
+	mkdir := mustParseOne(t, FormatMkdir)
+	if n := mkdir.FieldNumber("pathname"); n != 0 {
+		t.Errorf("mkdir FieldNumber(pathname) = %d, want 0", n)
+	}
+}
+
 func TestGenerateExecHandler(t *testing.T) {
 	output := generateFromPair(t, FormatExecveat, FormatExitExecveat)