Theo de Raadt <deraadt@openbsd.org> wrote:

> Any openat of a locked dirfd is supposed to result in a locked descriptor,
> so I may be missing some code.

There are two problems.  I'll work on it.