fix(classify): assign fanotify_mark to FamilyIPC, not Misc

fanotify_mark(2) adds, removes, or modifies a mark on an fanotify
notification group. Its arg0 is the fanotify group fd returned by
fanotify_init(2); it carries a dirfd@arg3 and an optional pathname@arg4
and returns 0/-1 (not a byte count). It is the operation counterpart of
fanotify_init and the direct analog of inotify_add_watch (both register a
watch/mark on a filesystem object via the notification-group fd).

inotify_add_watch is FamilyIPC, and fanotify_init was just moved Misc->IPC
to sit with the fd-based event-notification primitives (eventfd, signalfd,
timerfd, userfaultfd, inotify_*). fanotify_mark, however, was still falling
through to FamilyMisc by omission from the explicit family table -- the same
alarm/adjtimex-style misclassification fixed for fanotify_init in 88769d4,
and flagged there as still-outstanding for fanotify_mark. Add it to the IPC
family map for sibling consistency and regenerate.

KIND is unchanged and correct: KindPathname capturing the optional
pathname at args[4]. This matches the *at() cohort convention (fchmodat,
fchownat, unlinkat, mkdirat, newfstatat, utimensat, name_to_handle_at all
carry a dirfd at arg0 yet capture the pathname), since fanotify_mark has a
dirfd@arg3 + pathname@arg4 pair. RET stays UNCLASSIFIED (returns 0/-1).
Docs plan updated to keep the docs-drift tests in sync.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 14 insertions, 1 deletions

diff --git a/internal/generate/family.go b/internal/generate/family.go
index a74f7a8..8f4752c 100644
--- a/internal/generate/family.go
+++ b/internal/generate/family.go
@@ -40,8 +40,21 @@ var syscallFamilies = map[string]SyscallFamily{
 	// alarm/adjtimex-style misclassification). The flags argument is at args[0]
 	// (KindEventfd / eventfd flags capture) and the returned fd is captured via
 	// the fd mechanism, so the return is UNCLASSIFIED (not a byte count).
-	// fanotify_mark stays out of this table (path-marking, not fd creation).
+	//
+	// fanotify_mark(2) adds/removes/modifies a mark on an fanotify group and is
+	// the operation counterpart of fanotify_init — the direct analog of
+	// inotify_add_watch (both register a watch/mark on a filesystem object,
+	// taking the notification-group fd as arg0). inotify_add_watch is FamilyIPC,
+	// so for sibling consistency fanotify_mark belongs in IPC too rather than
+	// falling through to Misc by omission (the same alarm/adjtimex-style
+	// misclassification just fixed for fanotify_init). Its KIND stays KindPathname
+	// capturing the (optional) pathname at args[4]: this matches the *at() cohort
+	// convention — fchmodat, fchownat, unlinkat, mkdirat, newfstatat, utimensat,
+	// name_to_handle_at all carry a dirfd at arg0 yet capture the pathname — since
+	// fanotify_mark has a dirfd@arg3 + pathname@arg4 pair. fanotify_mark returns
+	// 0/-1, so the return is UNCLASSIFIED (not a byte count).
 	"fanotify_init": FamilyIPC,
+	"fanotify_mark": FamilyIPC,
 	"inotify_add_watch": FamilyIPC,
 	"inotify_init": FamilyIPC, "inotify_init1": FamilyIPC, "inotify_rm_watch": FamilyIPC,
 	"memfd_create": FamilyIPC, "memfd_secret": FamilyIPC, "mq_getsetattr": FamilyIPC,