update

docs/pre11-batch-c.md

@@ -0,0 +1,99 @@
+# Pre11 Batch C: ACL Parsing Responsibilities
+
+## Scope
+
+This batch mechanically separates POSIX ACL wire-format parsing from the
+FreeBSD vnode and xattr acquisition path.
+
+Modified files:
+
+- `src/xattr.c`
+- `docs/pre11-batch-c.md`
+
+No xattr body loading, header-only xattr behavior, namespace handling, public
+VOP interface, build configuration, or test infrastructure was changed.
+
+## Responsibility Split
+
+`erofs_get_acl()` continues to own:
+
+- mount option and ACL type validation;
+- the default-ACL directory restriction;
+- no-ACL filter handling and mode fallback;
+- xattr namespace and name selection;
+- both `erofs_getxattr()` stages;
+- FreeBSD `uio` and `iovec` setup;
+- `ENOATTR` fallback and the stack input buffer.
+
+The new `erofs_posix_acl_from_xattr()` receives an already-read buffer and
+owns only wire-format validation and ACL population. It borrows both the input
+buffer and output ACL and performs no allocation, release, lookup, or vnode
+operation.
+
+`erofs_acl_from_mode()` now receives the inode mode directly. This preserves
+the original fallback writes while preventing the parser from depending on an
+`erofs_node`.
+
+## Moved-Code Mapping
+
+The parsing block formerly at the end of `erofs_get_acl()` was moved in the
+same statement order into `erofs_posix_acl_from_xattr()`:
+
+1. Header length and entry-size remainder validation.
+2. Header copy and version validation.
+3. Entry count calculation and maximum check.
+4. Zero-entry mode fallback.
+5. `acl_cnt` assignment and phase initialization.
+6. Permission validation before tag-phase validation.
+7. Tag phase transitions and `UINT32_MAX` rules.
+8. Duplicate named user and group ID checks.
+9. ACL entry writes and undefined-ID mapping.
+10. The short-circuit `phase != 6 || acl_posix1e_check(aclp) != 0` check.
+
+No ACL zeroing or additional field initialization was added. Partial ACL
+mutation on malformed input remains possible exactly as before.
+
+## Branch Matrix
+
+| Input or state | Preserved result |
+| --- | --- |
+| POSIX ACL mount option disabled | `EOPNOTSUPP` in caller |
+| Unsupported ACL type | `EINVAL` in caller |
+| Default ACL requested for non-directory | `EINVAL` in caller |
+| No-ACL filter match | Mode-derived ACL in caller |
+| ACL xattr absent | Mode-derived ACL in caller |
+| Xattr lookup/read failure | Original error from caller |
+| Oversized xattr or nonzero UIO residual | `EINTEGRITY` in caller |
+| Short or misaligned wire value | `EINTEGRITY` in parser |
+| Unsupported wire version | `EINTEGRITY` in parser |
+| Entry count above limit | `EINTEGRITY` in parser |
+| Zero entries | Mode-derived ACL in parser |
+| Invalid permission, phase, tag, or ID | `EINTEGRITY` in parser |
+| Duplicate named user/group ID | `EINTEGRITY` in parser |
+| Missing required mask or incomplete phase | `EINTEGRITY` in parser |
+| Valid ACL | Identical ACL entry population and success |
+
+## Resource And Error Audit
+
+- The input buffer remains stack-owned by `erofs_get_acl()`.
+- The parser does not allocate, free, or retain pointers.
+- There are no new cleanup paths.
+- Xattr errors, UIO residual errors, wire errors, and ACL validation errors
+  retain their previous ordering.
+- `erofs_xattr_load_body()` and its release paths were not modified.
+- The optional header validation helper was intentionally omitted to avoid
+  touching the known header-only behavior.
+
+## Static Verification
+
+The batch is validated with:
+
+- a strict two-file path whitelist;
+- unique definitions of `erofs_get_acl()`, `erofs_acl_from_mode()`, and
+  `erofs_posix_acl_from_xattr()`;
+- pre/post comparison of parser returns, phase transitions, ACL writes, and
+  duplicate-ID checks;
+- `git diff --check`;
+- confirmation that `erofs_xattr_load_body()` is absent from the source diff.
+
+No build, QEMU smoke test, or feature test was run for this mechanical split.