[AlexWhitehouse]

What

On Linux, guest fscanf, vfscanf, scanf and vscanf on a stream open only for writing returned EOF with EBADF but left the error indicator clear. #14878 fixed reads on such streams for Windows and recorded this Linux gap in docs/dev/debt/libc.md:

• Cause: the glibc branch of FileStream::SwitchToReadingUnlocked (core/libs/prx/libc/include/FileStream.hpp) let a non-readable stream through to glibc's __vfscanf_internal. That function rejects _IO_NO_READS without setting _IO_ERR_SEEN.
• Source: FreeBSD 11.4's __srefill sets errno = EBADF and __SERR, then returns EOF.

Change:

• Reads: the glibc branch of SwitchToReadingUnlocked now fails a stream that __freadable rejects exactly as the Windows branch does: errno 9, the guest error indicator, and false. Every read path already returns on a failed switch, so fscanf and vfscanf now report EBADF with the error indicator, like fread, fgetc, getc_unlocked and fgets already did through glibc's underflow. Update streams take the same path as before.
• Pushback: FileStream::OpenForReading gains a glibc branch (__freadable). As a result, ungetc and ungetwc on a write-only stream return EOF without setting errno or the error indicator, as FreeBSD 11.4's __ungetc does ((fp->_flags & __SRD) == 0 and no __SRW) and as Windows has since fix(libc): fail reads on a write-only stream with EBADF on Windows #14878. Before, glibc pushed the character back onto the write-only stream.
• Other hosts: the Windows and macOS code is unchanged.
• Debt: the Linux clause of the "Reads on a write-only stream" entry is resolved. The entry now records only that macOS is expected to follow BSD stdio and has not been run.

Tested

• file_streams (CheckReadsOnWriteOnlyStreams): the fscanf checks (errno == EBADF, ferror != 0) and the ungetc check (EOF, errno 0, ferror 0) used to run on Windows only and now run on every host. New checks:

  • vfscanf through the existing va_list helper;
  • fgetwc;
  • ungetwc;
  • ferror == 0 after each clearerr.

  No existing assertion was removed or weakened.

• Linux x86-64 (Ubuntu 26.04, GCC 15, glibc 2.43, Release):

  • with main's FileStream.hpp, file_streams fails with fscanf on a write-only stream left errno or the error indicator unset;
  • with this PR (efe547e), the run ctest -R 'guest_binary_word|guest_fwide|file_streams|file_position|guest_standard_streams|file_stream_status|guest_wide_stream_scan|guest_stream_purge|guest_append_streams|guest_host_streams' passes 14/14;
  • mutation check: removing the new OpenForReading branch fails with ungetc on a write-only stream, and removing the new read check fails with the fscanf message above.

• Windows 11 (build 26300, WinLibs MinGW-w64 GCC 15.2.0 UCRT, Release):

  • the same 14 tests pass at efe547e;
  • with main's FileStream.hpp, file_streams also passes, as expected: Windows already behaved this way since fix(libc): fail reads on a write-only stream with EBADF on Windows #14878, and the Windows code is unchanged.

• python3 tools/check_conventions.py --base origin/main: all conventions checks passed.

• python3 tools/pr_overlap.py --branch fix/libc-linux-scanf-write-only-error: no confirmed overlap among the 141 PRs it could merge.

  • The PRs it could not compare (feat(aot): consolidate native ARM64 compiler, runtime and consumers #5021, feat(libc): scan 16-bit wide conversions on Linux #7386, feat(libc): support archive-backed stdio reads #7447, fix(libc): support character reads from random device streams #8150, fix(libc): share multibyte state in fgetwc #10405, feat(libc): implement fcloseall with tracked stream lifetimes #11831, fix(relinker): match AppContent utility import to provider #13486, fix(libc): translate native stream write errors #14559, fix(libc): translate native stream read errors #14560, and others touching only docs/dev/debt/libc.md) already conflict with main.
  • Trial merges with fix(libc): leave write mode when an unbuffered update stream switches to reading on Windows #12036 (update-stream switch) and fix(libc): give an unbuffered stream FreeBSD's one-byte buffer on Windows #12057 (UCRT buffering) are clean.
  • docs(libc): name what happens on Windows when ungetc is called twice #14326 (a docs-only ungetc note) adds its entry directly after the edited debt line, so whichever merges second has a one-line conflict there; keep both entries.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

🤖 Generated with Claude Code