# Pastebin lbHA1Mxl
● Path 1: constant flags (intercepted by pseudo)

  1. io/bits/fcntl2.h:48 — __builtin_constant_p(__oflag) is true
  2. io/bits/fcntl2.h:55 — calls __open_alias(__path, __oflag, __va_arg_pack())
  3. io/bits/fcntl2.h:27-28 — __open_alias is __REDIRECT to open
  4. → PLT call to open symbol → pseudo intercepts here

  Path 2: non-constant flags (bypasses pseudo)

  1. io/bits/fcntl2.h:48 — __builtin_constant_p(__oflag) is false
  2. io/bits/fcntl2.h:59 — calls __open_2(__path, __oflag)
  3. io/open_2.c:28 — calls __open(file, oflag)
  4. sysdeps/unix/sysv/linux/open.c:47 — __open is weak_alias of __libc_open
  5. sysdeps/unix/sysv/linux/open.c:43 — calls SYSCALL_CANCEL(openat, AT_FDCWD, file, oflag, mode)
  6. sysdeps/unix/sysdep.h:251-252 — SYSCALL_CANCEL expands to __SYSCALL_CANCEL_CALL
  7. sysdeps/unix/sysdep.h:111-112 — expands through INLINE_SYSCALL_CALL → __INLINE_SYSCALL_DISP
  8. sysdeps/unix/sysdep.h:91-92 — __INLINE_SYSCALL4(openat, AT_FDCWD, file, oflag, mode)
  9. sysdeps/unix/sysdep.h:42-48 — INLINE_SYSCALL(openat, 4, ...) → INTERNAL_SYSCALL(openat, 4, ...)
  10. sysdeps/unix/sysv/linux/x86_64/sysdep.h:234-235 — internal_syscall4(SYS_openat, ...)
  11. sysdeps/unix/sysv/linux/x86_64/sysdep.h ~line 282 — inline asm volatile ("syscall\n\t") → raw syscall, pseudo never sees it

  Step 6 is slightly simplified — I showed the IS_IN(rtld) path at line 247 which goes straight to INLINE_SYSCALL_CALL. The non-rtld path at line 251 goes through the cancellation machinery first, but ultimately reaches the same
  INLINE_SYSCALL → inline asm endpoint.