A virtual filesystem locking surprise

My understanding is that this is (well, *was*) ostensibly impossible, because the requirement is twofold: there is only one reference to this file descriptor, _and_ the process that has that reference is single-threaded.

The logic goes like this:
1. Only one reference exists to this file descriptor
2. The reference belongs to a process with only one thread
3. Therefore, right now, there is only one thread that can access or manipulate this file descriptor
4. Right now, that thread is busy running executing this function, which means it can't conflict with anything.

The problem, then, is that io_uring and pidfd_getfd violate the validity of the leap from 2->3. pidfd_getfd would do what you mentioned: it allows the reference count to be incremented by a thread from another process. io_uring, on the other hand, seems to do work on threads that don't get "counted" for #2.