One bug found by Specula:
do_clone attaches the child thread and increments nr_threads before calling the platform spawn path. The SNP platform then moves ThreadStartArgs through Box::into_raw; if the host clone3 call fails, result? returns without reconstructing/dropping that box, so the child ThreadState never detaches. The leaked phantom thread is visible through sys_sysinfo().procs and can block process quiescence through wait_for_exit / exec thread-kill waiting.
See the report for more details.
One bug found by Specula:
do_clone attaches the child thread and increments nr_threads before calling the platform spawn path. The SNP platform then moves ThreadStartArgs through Box::into_raw; if the host clone3 call fails, result? returns without reconstructing/dropping that box, so the child ThreadState never detaches. The leaked phantom thread is visible through sys_sysinfo().procs and can block process quiescence through wait_for_exit / exec thread-kill waiting.
See the report for more details.