A developer investigating a crash in their iOS VM project discovered that Unix domain sockets used for TTY emulation were returning different inode numbers on successive fstat() calls, causing a sanity check to fail only after device reboot. The issue emerged while finalizing code for a project that implements multi-processing semantics and runs an SSH server within an iOS app by overriding process-creation functions.
A technique for executing ELF binaries in memory without creating named files uses O_TMPFILE to allocate an anonymous inode and execveat(AT_EMPTY_PATH) to execute it, leaving only a /tmp/#N (deleted) trace in process telemetry. The method works on Linux 3.19+ by bypassing directory entry creation, making it invisible to file monitoring tools like inotify and fanotify.