GeezerVison

Summary

Extract the negative-descriptor fstat guard from #8954 for the Python 3.14 main branch.

os.stat(-5) and os.fstat(-5) can reach rustix with an invalid ordinary descriptor and panic in debug builds. Return EBADF at the shared non-Windows fstat boundary before calling rustix. Add an interpreter regression covering several negative values, including numbers used as directory-descriptor sentinels elsewhere.

This is a four-line implementation change plus one new Rust integration test. Directory-fd parsing and canonical Python tests are unchanged. It is independent of the closerange/termination fixes in #9006.

Validation

Fresh main-based validation on Linux, with source/runtime identity checked:

• Unpatched main panics on the focused probe and the exact new integration test; the split passes both.
• Normal commit hooks and strict workspace/C-API Clippy passed.
• Workspace tests: 1,353 passed, 18 existing ignored. Separate C-API tests: 116 passed, 4 existing ignored.
• Dev and production-feature release builds passed. Both return EBADF for the tested negative descriptors and preserve valid/closed-fd behavior and six existing supported directory-fd cases.
• The explicit 22-test canonical selection passed in both builds, with eight unchanged platform/implementation skips. The release test_os fstat selection also passed through cargo run.

The initial broader FileTests run aborts in the separate test_closerange case. The same case aborts on unpatched main; #9006 addresses it. That failed result is retained, and the successful selection excludes that case without changing tests or adding skips. Full local test_os remains unrun because its asyncio setup requires the sandbox-denied AF_UNIX socketpair. Hosted tests remain enabled; cross-platform CI is pending.

The runtime is main's Python 3.14.alpha. Any CPython comparison used the available 3.15.0rc3 interpreter, not a CPython 3.14 build.

AI assistance

Codex assisted with implementation, extraction, source review, regression tests, and automated validation. The original implementation authorship and Assisted-by trailer are preserved; the regression commit also includes its disclosure.