Guard-inconsistency across sibling DRIVERS + reverse-port-lag (a fork lags its own upstream) - Incus QEMU vs LXC

Banked: 2026-07-15, cycle360 (Incus CVE-2026-48752 incomplete-fix in the QEMU driver = HIGH/Critical, undisclosed).

The two compounding tells (both from my session lens set, now proven on a Critical target)

1. Guard-inconsistency across SIBLING DRIVERS/BACKENDS (not just sibling functions). When a security fix is applied at a per-consumer point (here: template application), a project with MULTIPLE parallel implementations (LXC container driver + QEMU VM driver) often gets the fix in ONE and not the sibling. Incus's CVE-2026-48752 fix added os.Root + Lstat + filepath.Base guards to driver_lxc.go but left driver_qemu.go templateApplyNow on plain os.Create/os.ReadFile with attacker-controlled tpl.Template = arbitrary host R/W. AUDIT RULE: when you see a containment fix in driver/backend A, grep for the SIBLING driver/backend B doing the same operation (here: templateApplyNow in both drivers) and check B has the same guard. Multi-driver projects (storage backends, instance types, transport types) are prime for this.
2. REVERSE port-lag: a fork can LAG ITS OWN UPSTREAM. Incus forked from LXD. LXD confined BOTH drivers via a central OpenTemplates() (os.Root); Incus ported it to LXC ONLY. So the DOWNSTREAM fork (incus) lags the UPSTREAM (LXD) on completeness. This inverts the usual port-lag (upstream-ahead-fork-behind). AUDIT RULE: for a fork/upstream pair, diff BOTH directions - the fork may have an incomplete port of the upstream's complete fix (grep the upstream for the safe primitive OpenTemplates/os.Root, then check the fork ported it to EVERY call site). The upstream that did it right IS the reference remediation to cite.

The reference remediation (cite)

LXD d.OpenTemplates() = an os.Root over the templates dir, read via templatesRoot.ReadFile(tpl.Template) + templatesRoot.Lstat in BOTH drivers. The complete fix for incus = add the same os.Root confinement to driver_qemu.go templateApplyNow. (os.Root again = the structural symlink-safe primitive, cf Forgejo/consul-template lessons.)

Vein note: tar-extraction/template symlink file-write is a HOT fresh cluster (2026-06/07)

Incus (CVE-2026-48752 + this sibling), OpenTofu (symlink->write->privesc), node-tar (CVE-2026-26960), BentoML (CVE-2026-27905), decompress (CVE-2026-39246), Backstage, extract-zip, ChatterBot. My os.Root/guard-inconsistency lenses apply directly + this class is point-fix-prone. High-EV fresh vein - continue mining (OpenTofu next: Go, Terraform port-lag angle).