Fix two bugs the Fedora move exposed

Neither is Fedora-specific. A different host and a freshly built
userland simply drove code that Windows never reached.

tools/mkfs.c did not compile at all. The DT_UNKNOWN/DT_DIR/DT_REG
fallbacks sat above <dirent.h>, so on glibc -- which spells them as
enumerators -- the #ifndef asked before the header was read, always
answered "missing", and then the header's own enum expanded to
`enum { 0 = 0, ... }`. Move the fallbacks below the include. The
include cannot move up instead: it has to follow the #undef that ends
the `#define dirent schfs_dirent` block.

getstackpcs() page-faulted. It dereferenced rbp[1] without validating
rbp, and the guard rejected 0xffffffff -- dead code on x86-64, already
caught by the KERNBASE test -- while the value that actually turns up
is all-ones, which is above KERNBASE. rbp[1] then wrapped to 0x7 and
took trap 14. `cp` panicked the kernel every time. Bound rbp from
above and require 8-byte alignment.

That second one masks other bugs: getcallerpcs() runs on every lock
acquisition and again from the trap handler, so a walker that can
fault replaces a real diagnosis with a bogus one.

Baseline on the Fedora laptop is now green: make ports, make,
make schfs-check including the round-trip that had never run, and
bootcheck at 27/27 plus 108 [ok] across the extended suites.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.claude/memory/MEMORY.md

@@ -1,7 +1,8 @@
 - [SchOS rename + git](schos-rename-and-git.md) — Schunix is SchOS and the kernel is SchIFT; the tree is under local git, and the two bugs the rename caused.
 - [Cross-platform build](schos-cross-platform-build.md) - Windows, Linux, macOS and BSD all build it; clang everywhere, and the four host assumptions that used to break.
 - [Memory sync](schos-memory-sync.md) - memory lives in the repo at .claude/memory/; tools/memory-sync.sh moves it between machines.
-- [The Linux machine](schos-linux-machine.md) - Fedora laptop at /home/nexoniarz/Documents/SchOS; the three things only it can test.
+- [The Linux machine](schos-linux-machine.md) - Fedora laptop at /home/nexoniarz/Documents/SchOS; the three things only it can test, all now green.
+- [Bugs the Fedora move exposed](schos-fedora-move-bugs.md) - mkfs.c's DT_* ordering, and a stack walker that page-faulted on an all-ones frame pointer.
 - [Performance and init](schos-performance-and-init.md) - BSIZE must equal SCHFS_BLKSIZE (4-34x), and why Ctrl-C could kill pid 1.
 - [Trusting bootcheck](schos-bootcheck-trust.md) - it silently stopped running; count the [ok] lines, never just grep FAIL.
 - [schinit](schos-schinit.md) - process 1 is launchd-shaped; job manifests, and why setsid() cost the shell its terminal.

.claude/memory/schos-fedora-move-bugs.md

@@ -0,0 +1,53 @@
+---
+name: schos-fedora-move-bugs
+description: "The two latent bugs the Fedora move exposed on 2026-08-09 — mkfs.c's DT_* ordering and the faulting stack walker in getstackpcs"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: d4821aa9-2e49-40da-91e7-90ef9ed9997e
+  modified: 2026-08-09T17:26:47.236Z
+---
+
+Moving to the Fedora laptop ([[schos-linux-machine]]) found two bugs that had
+been latent for a long time. Neither is Fedora-specific; a different host and a
+freshly built userland simply drove code Windows never reached.
+
+## 1. `tools/mkfs.c` would not compile at all
+
+The `DT_UNKNOWN` / `DT_DIR` / `DT_REG` fallbacks sat **above** `#include
+<dirent.h>`, with the other compatibility shims. glibc spells those as
+enumerators (with matching macros), so `#ifndef DT_UNKNOWN` asked before the
+header was read, always answered "missing", and defined them — after which the
+header's own `enum { DT_UNKNOWN = 0, ... }` expanded to `enum { 0 = 0, ... }`
+and died on a syntax error pointing at the `#define`, not the cause.
+
+The fallbacks now live **below** the include, with a comment saying why.
+`<dirent.h>` cannot move up instead: it has to follow the `#undef dirent` that
+ends the `#define dirent schfs_dirent` block, or it defines xv6's struct
+dirent rather than the host's. mingw-w64 never hit this because it genuinely
+lacks the constants.
+
+## 2. The stack walker page-faulted, in `kernel/core/spinlock.c`
+
+Symptom: `cp` panicked the kernel with `unexpected trap 14 ... cr2=0x7`.
+
+`getstackpcs()` walked the frame chain and dereferenced `rbp[1]` without
+validating `rbp`. The guard rejected `0`, anything below `KERNBASE`, and
+`0xffffffff` — but the value that actually turns up is all-ones,
+`0xffffffffffffffff`, which is **above** `KERNBASE` and passed. `rbp[1]` then
+wrapped to address `0x7`, exactly the reported `cr2`. The `0xffffffff` test was
+dead code on x86-64: it is far below `KERNBASE`, so the previous check already
+caught it.
+
+Fixed by bounding `rbp` from above (`> (addr_t)-16`) and requiring 8-byte
+alignment, rather than naming another magic constant.
+
+**Why this one matters more than it looks.** `getcallerpcs()` runs on *every*
+lock acquisition and again from the trap handler, so a walker that can fault
+replaces a real diagnosis with a second, more confusing one. A backtrace helper
+must never be able to fault.
+
+**Why it surfaced now:** `make ports` rebuilt toybox, and the new `cp` is not
+the stale binary that had been staged in `sysroot/`. It drove
+`fileread` → `ilock` → `acquiresleep` → `acquire` → `getcallerpcs` on a path
+the old one did not. Rebuilding a stale userland is itself a test.

.claude/memory/schos-linux-machine.md

@@ -1,8 +1,10 @@
 ---
 name: schos-linux-machine
-description: The Fedora laptop, its project path and memory key, and the three things only it can test
-metadata:
-  node_type: project
+description: "The Fedora laptop, its project path and memory key, and the three things only it can test"
+metadata: 
+  node_type: memory
+  originSessionId: d4821aa9-2e49-40da-91e7-90ef9ed9997e
+  modified: 2026-08-09T17:26:30.874Z
 ---
 
 Nexoniarz works from **two machines** and moved the project to the second on
@@ -25,15 +27,23 @@ session that learned something.
 matters:
 
 1. **`make ports`** builds musl, toybox and mksh from source. Windows cannot do
-   it at all — the build skips ports and uses whatever is staged in `sysroot/`,
-   which is why `sysroot/bin/sh` still carries the pre-rename symbol
-   `__schunix_tp`.
+   it at all — the build skips ports and uses whatever is staged in `sysroot/`.
 2. **The SchFS round-trip test** needs symlinks and hard links, which Git Bash
-   cannot create, so it skips on Windows. **It has never actually run** — the
-   one part of SchFS with no coverage.
+   cannot create, so it skips on Windows.
 3. **KVM.** A Ryzen box has SVM, so QEMU runs at native speed. Deliberately not
    the Makefile default: the suite's timings were set under TCG.
 
+**All three ran for the first time on 2026-08-09, and the baseline is green:**
+`make ports` (the rebuilt `sysroot/bin/sh` no longer carries `__schunix_tp`),
+`make`, `make schfs-check` — round-trip included, collision pass and all —
+and `bootcheck.ps1` at 27/27, then 108 `[ok]` with
+`-Fb -Tty -Usb -Sock -Evdev -Ps`. Expect one "no prompt" on `wc -c` in the
+extended run; the check it feeds still passes, so it is pacing, not a fault.
+
+**The move exposed two latent bugs, both fixed the same day** — see
+[[schos-fedora-move-bugs]]. Neither was Fedora's fault; the host and the
+freshly built userland simply drove paths Windows never did.
+
 **PowerShell has no Fedora package**, and `tools/windows/bootcheck.ps1` is the
 test suite. pwsh runs it on Linux fine; it comes from Microsoft's repo or the
 GitHub tarball. Nothing else needs it.