Audit security-sensitive syscall and user-buffer paths

[Pummelchen]

Summary

Audit security-sensitive syscall and user-buffer paths for capability, bounds, and secret-handling regressions.

Problem / objective

Syscall dispatch validates capabilities and user buffers, rejects credential material, and mediates filesystem/network/agent paths. This area should receive focused review before release-candidate claims.

Acceptance criteria

• Review syscall table, capability checks, and vmm_validate_user_buffer use.
• Review secret-material rejection and security telemetry counters.
• Add or update targeted validation if gaps are found.
• Do not relax capability/security policy without explicit design approval.

Validation

• make compile-check
• make qemu-smoke
• relevant security/update gate if changed

Relevant files

• kernel/user/syscall.c
• kernel/include/xaios/syscall.h
• kernel/runtime/security.c
• kernel/runtime/sandbox.c
• kernel/runtime/update.c
• userspace/include/xaios_user.h