kern/60786: poll reports socket writable after shutdown(SHUT_WR)

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60786
>Category:       kern
>Synopsis:       poll reports socket writable after shutdown(SHUT_WR)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Sep 24 22:05:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
The PollBSD Shutdown, Inc.
>Environment:
>Description:

	I don't know if there's language in POSIX about this but surely
	it is nonsensical for poll to claim that a socket is writable
	after it has been shut down in the writing direction!

	(This came up while trying to write a test that ensures SIGIO
	is reported in a particular direction, by shutting down writes
	so it won't report POLLOUT any more.)

>How-To-Repeat:
#include <sys/socket.h>

#include <err.h>
#include <poll.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>

int
main(void)
{
	int s[2];
	struct pollfd pfd;
	int nfds;

	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, s) == -1)
		err(EXIT_FAILURE, "socketpair");
	if (shutdown(s[0], SHUT_WR) == -1)
		err(EXIT_FAILURE, "shutdown");
	pfd.fd = s[0];
	pfd.events = POLLIN|POLLOUT;
	nfds = poll(&pfd, 1, 0);
	if (nfds == -1)
		err(EXIT_FAILURE, "poll");
	if (nfds == 1 && pfd.fd & (POLLIN|POLLOUT))
		errx(EXIT_FAILURE, "bad");
	return 0;
}

>Fix:

	Yes, please!