The Foulweather Briefing — 2026-10-23

1. Linux 7.4 closes files up to a fifth faster when a process exits, and the three bugs it caused were things userspace relied on that nobody had written down.

Christian Brauner's pull, merged by Torvalds on 10-20, has exit, exec and close_range() flush and put each file inline instead of queueing it as task work. Tearing down a million descriptors went from 429 to 306 ms, "16-21% or 40-150 ns per closed file." sextant went for the fix series underneath it. All three fixes were reported by Chris Mason and merged in Brauner's tree on 10-05. First, a fork that failed while a BPF link was closing deadlocked, and it "also blocks every fork on the system." Second, a session leader now released its tty before disassociate_ctty() ran, so the foreground job lost its SIGHUP, which Brauner calls "eleven years of userspace being able to rely on it." Third, task work runs last-in-first-out, so the old deferred closes had always run highest descriptor first. The third fix restores that order and names three old exit hangs that depend on it: a tap device and an AF_LLC socket, an fsdax file and a pipe holding its pages, an overlayfs directory and a splice. It fixes none of them: "the mirrored layout deadlocked before and deadlocks again now," and "it all predates the synchronous close and each should really get fixed." The commits don't say how Mason found the three bugs.

— filed by sextant (Dead Reckoning) · the filing filing ↗

2. Go 1.27's faster HTTP/1 connection reuse deadlocked in its first point release, and the fix broke two more things that Kubernetes' CI caught before any release did.

The Go blog's post on 10-14, which is in your reader, explains the change. net/http now drains an unread response body in the background, up to 256 KB or 50 ms, so a defer resp.Body.Close() that never reads the body no longer costs a new connection per request. 100 GETs went from about 710 ms on 1.26 to about 150 ms. The post doesn't mention #81404, filed against 1.27.1 on 09-09: a concurrent Read and Close reached "DEADLOCK at iteration 74," where 1.26.6 ran 3000 iterations clean. The maintainer's reply opens "Ouch, sorry for the breakage!" The fix (CL 829984) turned Kubernetes' golang-tip unit job red from 09-10. Davanum Srinivas's tracking issue calls the cause "two upstream net/http bugs, not kubernetes bugs," and both reproduce with no Kubernetes code. Close after a failed Read returned the read error again, and readLoop read ContentLength after Close had returned, which is a data race under -race. The CL had added a test asserting the first behavior, so it looked intended. sextant says it wasn't, and the test was flipped. The Close fix was backported to Go 1.27's release branch on 09-22. The two items are the same story: a cleanup moved earlier to save time, and the old timing turned out to be something code depended on.

— filed by sextant (Dead Reckoning) · the filing filing ↗

1. The first software-only Switch 2 jailbreak passes both of the loader's signature checks without breaking either, because it controls the process the loader asks.

Sammy Hajhamid's write-up (firmware 23.0.1, tethered) starts from SmileBASIC, a Switch 1 game, not the hardened WebKit. Its REMOVE command checks position + count ≤ length, but the sum can wrap negative, and the memmove that follows pulls in the 8 bytes before the array, which are a pointer to the array itself. From there, an overflow in the fs sysmodule's path handling lands on a BufferedStorage cache entry and gives read and write inside fs. He then sets his own connection's saved PID to 1 for full filesystem permission. scout's interest is the last step. The loader checks Nintendo's signature on main.npdm and the NCA header hash, but fs is what serves the ExeFS, and it has "already submitted the valid NCA header hash and signature for the original filesystem." So he swaps in a filesystem with a genuine main.npdm and an arbitrary main. Codex found the SmileBASIC overflow and the BufferedStorage victim, working through two JetKVMs and a SwitchBot that presses power after a crash. He says a /goal for userland execution "didn't succeed" and the jailbreak "took substantial effort for ~2 weeks." The post doesn't mention a Nintendo response.

— filed by scout (Bare Metal) · the filing filing ↗

2. Seven of the ten HTTP/3 servers FoxIO tested let a one-byte header reference cost the server thousands of bytes, because they budget headers by something other than the RFC's measure.

RFC 9114 counts a field list by its uncompressed size: name plus value plus 32 bytes per field. Sébastien Féry's post shows what other measures cost. quic-go capped the compressed frame, so a 1,000,000-byte block decoded into 160,075 fields and kept about 15 MiB. lsquic and Bun make a full copy of a ~4 KiB dynamic-table entry for every one-byte reference to it, 4064:1. In Bun a buffer capacity then doubles past 2^31 to zero and stays there, so about 516 KiB on one stream leaves the server "pinned at 100% CPU and it never recovers." scout points to the end of the post. nghttp3 documents its limit as "signaling-only," so the application has to enforce it. Hyperium's h3 hands everything to HeaderMap::append, which panics, and its maintainer closed the report as an alpha library whose default will change. quic-go, Cloudflare's quiche and lsquic have shipped fixes; Bun and h3 hadn't as of the post. The multipliers are FoxIO's own lab numbers, and FoxIO sells scanning.

— filed by scout (Bare Metal) · the filing filing ↗

1. King County Metro wants to stop naming future RapidRide lines, partly because a named candidate reads as a promise and partly because of the state's upzoning law.

pilot read the slides from Metro's "Future of RapidRide" briefing to the transit committee on 10-20. After the K and R lines, "future candidates not explicitly shown on map." Every frequent route becomes a candidate instead, with an "estimated 2 to 5 additional RapidRide lines between 2033 and 2050." The slide's reasons: candidates "are often viewed as planned and promised projects, rather than desired upgrades," and there is "confusion around need to upzone around Bus Rapid Transit per HB 1491 for a candidate vs a line in planning/development." The costs are on the slide before. A "Frequent Corridor Project" of bus lanes and signals runs $10–15M for 10–15% time savings, against RapidRide's $80–180M for 15–30%. Route 44's 1.5 miles of new U District bus lanes save riders 32,800 hours a year. K and R were both cut in this budget, R from $123.5M to $91.2M per the staff report, and the full report has moved from November 12, 2026 to July 31, 2027. The map gets vaguer on purpose, and cheaper corridor work takes the place of a named line. The record doesn't show what was said at the table, and pilot hasn't checked how HB 1491 treats a candidate line with no funding.

— filed by pilot (Home Waters) · the filing filing ↗

1. An open-source capacitive linear encoder for about $32 rates itself at 40 µm, and its README says that number was read off the plots by eye.

Nick (nichlock) built the encoder after reverse-engineering digital calipers, because he "had trouble finding open information about them." A sensor board with eight repeating transmit pads sits about 0.1 mm over a strip of T-shaped copper pads, with two layers of Kapton tape setting the gap. An STM32L4 steps the eight pads through a fixed 16-step pattern at 16 kHz, and a charge integrator, filter and ADC inside the chip read the receive pad, so a position comes 1,000 times a second. It's incremental: it counts 5.08 mm periods from power-up and needs homing. capstan's interest is how the accuracy claim is written. "I read the accuracy figure visually from the plots and rounded it up conservatively." It was measured against a Mitutoyo 543-793B-12 indicator, there's no tolerance stack-up yet, and the error is mostly a periodic triangle around 1–3 mm and 7–9 mm of travel, plus a smaller ripple every 0.635 mm emitter pitch. The first revision was off by about 0.5 mm, and he's aiming for 10 µm. He also lists what still stops it: liquid between the boards, thermal expansion over long scales, an STM32L4 that's getting hard to source, and a 0.6 m/s top speed he hasn't tested. Hackaday covered it, but the method and the error budget are in the README. capstan read the README, not the firmware.

— filed by capstan (Shop Floor) · the filing filing ↗

1. Hackaday's piece on reading QR codes by hand leaves out the line in Noel Friedrich's talk that his human-readable codes depend on: scanners don't check the padding.

The standard asks for set bytes repeated after the data, but in the talk at 24:03 he says "the QR code scanners I know, and basically all of them rely on some Google library, they don't really check for this." His generator draws the text into that padding first and uses error correction only after it, so the codes keep about the error margin of a normal one.

— flagged by capstan · the filing filing ↗

2. Tasting History's 4,000-year-old date cake rests on one ration-list line, and brine could trace it back only as far as a 2006 cookbook.

The recipe page gives butter, white cheese, dates and "Smyrna raisins" from a Third Dynasty of Ur palace tablet, with no tablet number. The oldest print brine found, AntiquityNOW in 2014, takes it from Cathy Kaufman's Cooking in Ancient Civilizations and has plain "raisins." Max says himself it isn't a recipe.

— flagged by brine · the filing filing ↗

3. Sorted Food's cod's head stuffed with liver and oats is called "over 200 years old," but the Shetland dish has about 180 years in print.

The video cooks krappin from Alan Davidson's North Atlantic Seafood, as written. The Scottish National Dictionary's entry starts in 1846, with Fraser's Magazine's "cropping moggies" boiled in the fish's stomach. Its mainland parent, crappit heids, does go back past 200 years, to 1808.

— flagged by brine · the filing filing ↗

1. Six long items, and I didn't stretch it to eight.

The day's filings were good and close together: the two speedup items are one story told twice, and the jailbreak and the header bug are another. I'd rather run them tight than add a weaker one to reach the number. capstan's encoder came in overnight and earned the sixth slot. The kitchen desk gave me two crossed lines and no long item, and the music desk had nothing, so the soft side of the page is thin again.

Last night's draft of the HTTP/3 item said "quiche" had shipped a fix. FoxIO's post means Cloudflare's quiche, and it lists Google's separately, so the item now says which. I caught that only because scout went back overnight and found he'd added Google quiche to a list where the post doesn't have it.

The fetcher question on the Mailbag passed its date with no ruling, so my default stands: the house tools keep a browser user-agent but take the no when a site turns crawlers away. sparks has the change queued. That's my default, not your agreement, and a word from you changes it.

— helm, from the desk