Dispatch write, writev, and readv on netlink fds

[Xalestar]

busybox ip addr under elfuse exits 1 on its first rtnetlink request:

$ build/elfuse --sysroot externals/test-fixtures/rootfs \
      externals/test-fixtures/rootfs/bin/busybox ip addr
ip: write error: Bad file descriptor

The verbose trace has the socket, the bind and the getsockname reaching the netlink handlers, and the request itself failing:

syscall 198 socket(16, 3, 0)    -> 3
syscall 200 bind(3, ...)        -> 0
syscall 204 getsockname(3, ...) -> 0
syscall 64  write(3, buf, 0x14) -> -9

netlink_socket() registers pipefd[0] as the host fd so that poll and epoll have something to wait on. sys_write() and sys_writev() carry no FD_NETLINK case, so the request reaches that pipe end, which is open read-only, and macOS returns EBADF. sys_readv() has the same gap for iovcnt > 1; a single entry already delegates to sys_read().

Linux accepts write() on a netlink socket as sendto() with no explicit destination, and busybox's libiproute sends every request that way. glibc getifaddrs() uses sendto and recvmsg, both already routed, which is why the existing coverage passes over the gap.

Scope: all eight spellings (sendto, sendmsg, write, writev, recvfrom, recvmsg, read, readv) reach one gather and one scatter, so a request split across iov entries is not truncated, a receive is not capped by its first entry, and nl_complete_span() bounds all four receive spellings alike.

tests/test-netlink.c drives each of the eight against a NETLINK_ROUTE socket and then the end-to-end getifaddrs() path that originally regressed. Every receive polls before it reads, so a regression fails an assertion instead of blocking the run, and the assertions hold for a real kernel too and run in the qemu column of the matrix.

Verification

Verified on macOS 26.6.1 (build 25G76), SDK 26.5, Apple M5 Pro, on a branch based on upstream/main at 3541d18.

make test-matrix stays within baseline in all three modes with zero failures: elfuse-aarch64 252 passed, qemu-aarch64 231 passed, elfuse-x86_64 78 passed. test-netlink is OK in the qemu-aarch64 column as well as the elfuse-aarch64 one, so all 22 assertions hold against a real 6.18 kernel.

make lint, .ci/check-format.sh, .ci/check-newline.sh, .ci/check-security.sh and .ci/check-matrix-lists.sh pass. .ci/check-cppcheck.sh needs mapfile, so it is left to the CI runner rather than this host's bash 3.2.

make check passes the unit suite and reports 81 of 84 in the BusyBox smoke, with one failure that is this host and not the branch: nslookup times out because no DNS server is reachable from here, and it fails the same way with the branch's changes backed out.

The new assertions fail without the change rather than passing vacuously. Against the branch's own sources backed out, the four that cover sendmsg and recvmsg:

FAIL: sendmsg() gathers a split request (errno=22 Invalid argument)
FAIL: recvmsg() fills past the first entry (errno=22 Invalid argument)
FAIL: the scattered recvmsg() bytes parse as RTM_NEWLINK (errno=22 Invalid argument)
FAIL: sendmsg() of an empty iovec fails with ENODATA (errno=22 Invalid argument)

With only the recvmsg scatter removed, so the two receive assertions stand on their own rather than on the send above them:

FAIL: recvmsg() fills past the first entry (errno=61 No data available)
FAIL: the scattered recvmsg() bytes parse as RTM_NEWLINK (errno=61 No data available)

Removing the sys_write and sys_writev dispatch:

FAIL: write(RTM_GETLINK) accepts the request (errno=9 Bad file descriptor)
FAIL: write() request produces an RTM_NEWLINK dump (errno=9 Bad file descriptor)
FAIL: write() of zero bytes fails with ENODATA (errno=0 Success)
FAIL: writev() of zero bytes returns 0 (errno=9 Bad file descriptor)
FAIL: writev(RTM_GETLINK) accepts a split request (errno=9 Bad file descriptor)
FAIL: writev() gathers the split request into one dump (errno=9 Bad file descriptor)

Removing the sys_readv dispatch leaves the readv drain empty, and the recvmsg pair after it fails on the buffer that drain would have emptied:

FAIL: readv() fills past the first entry (errno=61 No data available)
FAIL: the scattered readv() bytes parse as RTM_NEWLINK (errno=61 No data available)
FAIL: recvmsg() fills past the first entry (errno=61 No data available)
FAIL: the scattered recvmsg() bytes parse as RTM_NEWLINK (errno=61 No data available)