D01-MQ: Yes
Rationale
In an isolated Debian 13 guest running Linux 6.12.101+deb13-amd64, the retained picoquic c124cbe / Picotls f06553b build passed sockloop_ipv4 after permanent UID/GID drop to 65534, removal of supplementary groups, no_new_privs and zero effective/permitted/inherited/ambient capabilities. Root reacquisition was denied. Sockets were created by the unprivileged test executable, not pre-opened by a privileged network helper. The same ordinary-user executable separately passed upstream client_auth and multipath_basic. This closes the host setgroups blocker recorded in round 2.80 with an actual supported Linux endpoint execution.
Assessment method
One live-loopback test plus two simulated-network tests under ordinary-user credentials; all three exit zero
Source context
Executed QEMU/KVM guest experiment and pinned upstream tests
Outstanding qualification
The VM had no external NIC. sockloop_ipv4 exercises actual loopback UDP sockets; client_auth and multipath_basic use the upstream simulated-network harness and are not a combined live authenticated multipath deployment. Administrative image/installation provisioning and user-owned public test fixtures are disclosed. The build is reused unchanged from round 2.26; the guest launcher changes process credentials, not protocol code. This establishes routine privilege requirements, not independent interoperability, hybrid key exchange, full selected-profile conformance, external-path handover or performance. The multipath zero-path-limit issue and complete profile mapping in E03-MQ remain separate. No host permissions or privileges were changed.
Public sources
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round285-runtime.json
- round285_guest.py
- round285-sources.json
- round280-runtime.json
- round226-runtime.json