--- a/go.mod
+++ b/go.mod
@@ -96,14 +96,14 @@
 	go.uber.org/zap v1.28.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
 	golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
-	golang.org/x/net v0.59.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
 	golang.org/x/oauth2 v0.37.0 // indirect
-	golang.org/x/sync v0.23.0 // indirect
-	golang.org/x/sys v0.48.0 // indirect
-	golang.org/x/term v0.46.0 // indirect
-	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/sync v0.24.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/term v0.47.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/time v0.16.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
@@ -168,3 +168,5 @@
 replace k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.37.0
 
 replace k8s.io/sample-controller => k8s.io/sample-controller v0.37.0
+
+replace golang.org/x/net => golang.org/x/net v0.62.0
--- a/go.sum
+++ b/go.sum
@@ -207,22 +207,22 @@
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba h1:Ck8QetSgk912qxWLMCKxd0in+aiyBQyDSMae6e/xmpU=
 golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba/go.mod h1:50RgIsmK7OwqzTTeqcSXQW8SswW0o8fRcDxmqGluJ8E=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
-golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
 golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/net/http2/flow.go /work/src/external-snapshotter/vendor/golang.org/x/net/http2/flow.go
--- a/vendor/golang.org/x/net/http2/flow.go	2026-10-28 10:19:50.843179903 +0000
+++ b/vendor/golang.org/x/net/http2/flow.go	2026-10-28 10:20:23.450877695 +0000
@@ -10,6 +10,9 @@
 // flow control window update.
 const inflowMinRefresh = 4 << 10
 
+// maxFlowWindow is the maximum size of a flow control window.
+const maxFlowWindow = (1 << 31) - 1
+
 // inflow accounts for an inbound flow control window.
 // It tracks both the latest window sent to the peer (used for enforcement)
 // and the accumulated unsent window.
@@ -74,47 +77,99 @@
 	return true
 }
 
-// outflow is the outbound flow control window's size.
+// connOutflow is connection-level outbound flow control.
+type connOutflow struct {
+	initial int32 // SETTINGS_INITIAL_WINDOW_SIZE, changes with settings updates
+	n       int32 // connection-level flow control window
+	flowErr bool  // set when a flow control error is encountered
+}
+
+func (f *connOutflow) init() {
+	f.initial = initialWindowSize // initial stream window size
+	f.n = initialWindowSize       // current connection window size
+}
+
+func (f *connOutflow) changeInitialWindowSize(size int64) bool {
+	if size > maxFlowWindow {
+		f.flowErr = true
+		return false
+	}
+	f.initial = int32(size)
+	return true
+}
+
+func (f *connOutflow) add(n int32) bool {
+	sum := int64(f.n) + int64(n)
+	if sum > maxFlowWindow {
+		f.flowErr = true
+		return false
+	}
+	f.n += n
+	return true
+}
+
+// outflow is the stream-level outbound flow control window's size.
 type outflow struct {
 	_ incomparable
 
-	// n is the number of DATA bytes we're allowed to send.
-	// An outflow is kept both on a conn and a per-stream.
-	n int32
+	// delta is the difference between the stream's flow control window and
+	// the connection's initial window size (conn.initial).
+	//
+	// Another view is that delta is the number of flow control bytes provided to this
+	// stream in WINDOW_UPDATE frames, less the number of bytes sent on the stream.
+	delta int32
 
 	// conn points to the shared connection-level outflow that is
-	// shared by all streams on that conn. It is nil for the outflow
-	// that's on the conn directly.
-	conn *outflow
+	// shared by all streams on that conn.
+	conn *connOutflow
 }
 
-func (f *outflow) setConnFlow(cf *outflow) { f.conn = cf }
-
-func (f *outflow) available() int32 {
-	n := f.n
-	if f.conn != nil && f.conn.n < n {
-		n = f.conn.n
+func (f *outflow) available() (int32, bool) {
+	if f.conn == nil {
+		return maxFlowWindow, true // only happens in tests
 	}
-	return n
+	if f.conn.flowErr {
+		// Block all sending once any stream observes a flow control error.
+		return 0, false
+	}
+	n := int64(f.conn.initial) + int64(f.delta)
+	if n > maxFlowWindow {
+		f.conn.flowErr = true
+		return 0, false
+	}
+	return min(int32(n), f.conn.n), true
 }
 
 func (f *outflow) take(n int32) {
-	if n > f.available() {
-		panic("internal error: took too much")
+	if f.conn == nil {
+		return // only happens in tests
 	}
-	f.n -= n
-	if f.conn != nil {
-		f.conn.n -= n
+	avail, _ := f.available()
+	if n > avail {
+		panic("internal error: took too much")
 	}
+	f.delta -= n
+	f.conn.n -= n
 }
 
 // add adds n bytes (positive or negative) to the flow control window.
 // It returns false if the sum would exceed 2^31-1.
 func (f *outflow) add(n int32) bool {
-	sum := f.n + n
-	if (sum > n) == (f.n > 0) {
-		f.n = sum
-		return true
+	if f.conn == nil {
+		return true // only happens in tests
+	}
+	avail := int64(f.conn.initial) + int64(f.delta)
+	if avail > maxFlowWindow {
+		// An earlier change to the initial window pushed this stream over the limit.
+		// This is a connection-level flow control error.
+		f.conn.flowErr = true
+		return false
 	}
-	return false
+	if avail+int64(n) > maxFlowWindow {
+		// This update would push the stream over the limit.
+		// This is a stream-level flow control error.
+		return false
+	}
+	f.delta += n
+	return true
 }
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/net/http2/frame.go /work/src/external-snapshotter/vendor/golang.org/x/net/http2/frame.go
--- a/vendor/golang.org/x/net/http2/frame.go	2026-10-28 10:19:50.843179903 +0000
+++ b/vendor/golang.org/x/net/http2/frame.go	2026-10-28 10:20:23.450877695 +0000
@@ -1711,7 +1711,8 @@
 	mh := &MetaHeadersFrame{
 		HeadersFrame: hf,
 	}
-	var remainSize = fr.maxHeaderListSize()
+	var headersRemainSize = fr.maxHeaderListSize()
+	var trailersRemainSize = fr.maxHeaderListSize()
 	var sawRegular bool
 
 	var invalid error // pseudo header field errors
@@ -1743,14 +1744,29 @@
 			return
 		}
 
-		size := hf.Size()
-		if size > remainSize {
+		var remainSize *uint32
+		var size uint32
+		if hf.Name == "trailer" {
+			remainSize = &trailersRemainSize
+			fieldCount := strings.Count(hf.Value, ",") + 1
+			// Rather than actually constructing hpack.HeaderField for each
+			// trailer field and cumulatively adding its Size, just do the math
+			// manually to avoid unnecessary work. This does make it so
+			// whitespaces after comma are counted against the budget, but that
+			// should be innocuous.
+			size = uint32(len(hf.Value)-fieldCount+1) + uint32(fieldCount)*hpack.HeaderField{}.Size()
+		} else {
+			remainSize = &headersRemainSize
+			size = hf.Size()
+		}
+		if size > *remainSize {
 			hdec.SetEmitEnabled(false)
 			mh.Truncated = true
-			remainSize = 0
+			headersRemainSize = 0
+			trailersRemainSize = 0
 			return
 		}
-		remainSize -= size
+		*remainSize -= size
 
 		mh.Fields = append(mh.Fields, hf)
 	})
@@ -1766,10 +1782,10 @@
 		// skip parsing the fragment and close the connection.
 		//
 		// "Too much" is either any CONTINUATION frame after we've already
-		// exceeded the max header list size (in which case remainSize is 0),
-		// or a frame whose encoded size is more than twice the remaining
-		// header list bytes we're willing to accept.
-		if int64(len(frag)) > int64(2*remainSize) {
+		// exceeded the max header list size (if so, both budgets are 0), or a
+		// frame whose encoded size is more than twice the remaining header
+		// list bytes we're willing to accept.
+		if int64(len(frag)) > 2*int64(headersRemainSize+trailersRemainSize) {
 			if VerboseLogs {
 				log.Printf("http2: header list too large")
 			}
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/net/http2/server.go /work/src/external-snapshotter/vendor/golang.org/x/net/http2/server.go
--- a/vendor/golang.org/x/net/http2/server.go	2026-10-28 10:19:50.843179903 +0000
+++ b/vendor/golang.org/x/net/http2/server.go	2026-10-28 10:20:23.450877695 +0000
@@ -280,7 +280,6 @@
 		doneServing:                 make(chan struct{}),
 		clientMaxStreams:            math.MaxUint32, // Section 6.5.2: "Initially, there is no limit to this value"
 		advMaxStreams:               conf.MaxConcurrentStreams,
-		initialStreamSendWindowSize: initialWindowSize,
 		initialStreamRecvWindowSize: conf.MaxUploadBufferPerStream,
 		maxFrameSize:                initialMaxFrameSize,
 		pingTimeout:                 conf.PingTimeout,
@@ -320,7 +319,7 @@
 	// These start at the RFC-specified defaults. If there is a higher
 	// configured value for inflow, that will be updated when we send a
 	// WINDOW_UPDATE shortly after sending SETTINGS.
-	sc.flow.add(initialWindowSize)
+	sc.flow.init()
 	sc.inflow.init(initialWindowSize)
 	sc.hpackEncoder = hpack.NewEncoder(&sc.headerWriteBuf)
 	sc.hpackEncoder.SetMaxDynamicTableSizeLimit(conf.MaxEncoderHeaderTableSize)
@@ -427,7 +426,7 @@
 	wroteFrameCh     chan frameWriteResult  // from writeFrameAsync -> serve, tickles more frame writes
 	bodyReadCh       chan bodyReadMsg       // from handlers -> serve
 	serveMsgCh       chan interface{}       // misc messages & code to send to / run on the serve loop
-	flow             outflow                // conn-wide (not stream-specific) outbound flow control
+	flow             connOutflow            // conn-wide (not stream-specific) outbound flow control
 	inflow           inflow                 // conn-wide inbound flow control
 	tlsState         *tls.ConnectionState   // shared by all handlers, like net/http
 	remoteAddrStr    string
@@ -441,6 +440,9 @@
 	sawFirstSettings            bool // got the initial SETTINGS frame after the preface
 	needToSendSettingsAck       bool
 	unackedSettings             int    // how many SETTINGS have we sent without ACKs?
+	pendingEncoderTableSize     bool   // peer changed SETTINGS_HEADER_TABLE_SIZE; apply to hpackEncoder before the next frame write
+	encoderTableSizeMin         uint32 // smallest SETTINGS_HEADER_TABLE_SIZE since the last apply
+	encoderTableSize            uint32 // latest SETTINGS_HEADER_TABLE_SIZE
 	queuedControlFrames         int    // control frames in the writeSched queue
 	clientMaxStreams            uint32 // SETTINGS_MAX_CONCURRENT_STREAMS from client (our PUSH_PROMISE limit)
 	advMaxStreams               uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client
@@ -451,7 +453,6 @@
 	maxPushPromiseID            uint32 // ID of the last push promise (even), or 0 if there have been no pushes
 	streams                     map[uint32]*stream
 	unstartedHandlers           []unstartedHandler
-	initialStreamSendWindowSize int32
 	initialStreamRecvWindowSize int32
 	maxFrameSize                int32
 	peerMaxHeaderListSize       uint32            // zero means unknown (default)
@@ -521,7 +522,8 @@
 	// immutable:
 	sc        *serverConn
 	id        uint32
-	body      *pipe       // non-nil if expecting DATA frames
+	body      *pipe // non-nil if expecting DATA frames
+	reqBody   *requestBody
 	cw        closeWaiter // closed wait stream transitions to closed state
 	ctx       context.Context
 	cancelCtx func()
@@ -1172,6 +1174,16 @@
 
 	sc.writingFrame = true
 	sc.needsFrameFlush = true
+	if sc.pendingEncoderTableSize {
+		// hpackEncoder may be in use by writeFrameAsync, so SETTINGS
+		// changes to it are deferred until no frame is being written.
+		// Replaying the smallest size before the latest one keeps the
+		// encoder's view identical to having applied every change
+		// (RFC 7541, Section 4.2).
+		sc.pendingEncoderTableSize = false
+		sc.hpackEncoder.SetMaxDynamicTableSize(sc.encoderTableSizeMin)
+		sc.hpackEncoder.SetMaxDynamicTableSize(sc.encoderTableSize)
+	}
 	if wr.write.staysWithinBuffer(sc.bw.Available()) {
 		sc.writingFrameAsync = false
 		err := wr.write.writeFrame(sc)
@@ -1271,6 +1283,11 @@
 	}
 	sc.inFrameScheduleLoop = true
 	for !sc.writingFrameAsync {
+		if sc.flow.flowErr && (!sc.inGoAway || sc.goAwayCode == ErrCodeNo) {
+			sc.inGoAway = true
+			sc.needToSendGoAway = true
+			sc.goAwayCode = ErrCodeFlowControl
+		}
 		if sc.needToSendGoAway {
 			sc.needToSendGoAway = false
 			sc.startFrameWrite(FrameWriteRequest{
@@ -1294,6 +1311,9 @@
 				sc.startFrameWrite(wr)
 				continue
 			}
+			if sc.flow.flowErr {
+				continue
+			}
 		}
 		if sc.needsFrameFlush {
 			sc.startFrameWrite(FrameWriteRequest{write: flushFrameWriter{}})
@@ -1526,6 +1546,10 @@
 			return nil
 		}
 		if !st.flow.add(int32(f.Increment)) {
+			if st.flow.conn.flowErr {
+				// This is a lazily-detected connection-level flow control error.
+				return sc.countError("bad_flow", ConnectionError(ErrCodeFlowControl))
+			}
 			return sc.countError("bad_flow", streamError(f.StreamID, ErrCodeFlowControl))
 		}
 	default: // connection-level flow control
@@ -1584,10 +1608,6 @@
 		}
 	}
 	if p := st.body; p != nil {
-		// Return any buffered unread bytes worth of conn-level flow control.
-		// See golang.org/issue/16481
-		sc.sendWindowUpdate(nil, p.Len())
-
 		p.CloseWithError(err)
 	}
 	if e, ok := err.(StreamError); ok {
@@ -1641,7 +1661,12 @@
 	}
 	switch s.ID {
 	case SettingHeaderTableSize:
-		sc.hpackEncoder.SetMaxDynamicTableSize(s.Val)
+		// Applied by startFrameWrite; see comment there.
+		if !sc.pendingEncoderTableSize || s.Val < sc.encoderTableSizeMin {
+			sc.encoderTableSizeMin = s.Val
+		}
+		sc.encoderTableSize = s.Val
+		sc.pendingEncoderTableSize = true
 	case SettingEnablePush:
 		sc.pushEnabled = s.Val != 0
 	case SettingMaxConcurrentStreams:
@@ -1672,28 +1697,14 @@
 
 func (sc *serverConn) processSettingInitialWindowSize(val uint32) error {
 	sc.serveG.check()
-	// Note: val already validated to be within range by
-	// processSetting's Valid call.
-
-	// "A SETTINGS frame can alter the initial flow control window
-	// size for all current streams. When the value of
-	// SETTINGS_INITIAL_WINDOW_SIZE changes, a receiver MUST
-	// adjust the size of all stream flow control windows that it
-	// maintains by the difference between the new value and the
-	// old value."
-	old := sc.initialStreamSendWindowSize
-	sc.initialStreamSendWindowSize = int32(val)
-	growth := int32(val) - old // may be negative
-	for _, st := range sc.streams {
-		if !st.flow.add(growth) {
-			// 6.9.2 Initial Flow Control Window Size
-			// "An endpoint MUST treat a change to
-			// SETTINGS_INITIAL_WINDOW_SIZE that causes any flow
-			// control window to exceed the maximum size as a
-			// connection error (Section 5.4.1) of type
-			// FLOW_CONTROL_ERROR."
-			return sc.countError("setting_win_size", ConnectionError(ErrCodeFlowControl))
-		}
+	if !sc.flow.changeInitialWindowSize(int64(val)) {
+		// 6.9.2 Initial Flow Control Window Size
+		// "An endpoint MUST treat a change to
+		// SETTINGS_INITIAL_WINDOW_SIZE that causes any flow
+		// control window to exceed the maximum size as a
+		// connection error (Section 5.4.1) of type
+		// FLOW_CONTROL_ERROR."
+		return sc.countError("setting_win_size", ConnectionError(ErrCodeFlowControl))
 	}
 	return nil
 }
@@ -1966,7 +1977,7 @@
 	if st.reqTrailer != nil {
 		st.trailer = make(http.Header)
 	}
-	st.body = req.Body.(*requestBody).pipe // may be nil
+	st.body = st.reqBody.pipe // may be nil
 	st.declBodyBytes = req.ContentLength
 
 	handler := sc.handler.ServeHTTP
@@ -1989,7 +2000,7 @@
 		st.readDeadline = time.AfterFunc(sc.hs.ReadTimeout, st.onReadTimeout)
 	}
 
-	return sc.scheduleHandler(id, rw, req, handler)
+	return sc.scheduleHandler(st, rw, req, handler)
 }
 
 func (sc *serverConn) upgradeRequest(req *http.Request) {
@@ -2102,7 +2113,6 @@
 	}
 	st.cw.Init()
 	st.flow.conn = &sc.flow // link to conn-level counter
-	st.flow.add(sc.initialStreamSendWindowSize)
 	st.inflow.init(sc.initialStreamRecvWindowSize)
 	if sc.hs.WriteTimeout > 0 {
 		st.writeDeadline = time.AfterFunc(sc.hs.WriteTimeout, st.onWriteTimeout)
@@ -2184,7 +2194,7 @@
 		} else {
 			req.ContentLength = -1
 		}
-		req.Body.(*requestBody).pipe = &pipe{
+		st.reqBody.pipe = &pipe{
 			b: &dataBuffer{expected: req.ContentLength},
 		}
 	}
@@ -2204,7 +2214,7 @@
 		return nil, nil, sc.countError(res.InvalidReason, streamError(st.id, ErrCodeProtocol))
 	}
 
-	body := &requestBody{
+	st.reqBody = &requestBody{
 		conn:          sc,
 		stream:        st,
 		needsContinue: res.NeedsContinue,
@@ -2220,7 +2230,7 @@
 		ProtoMinor: 0,
 		TLS:        tlsState,
 		Host:       rp.Authority,
-		Body:       body,
+		Body:       st.reqBody,
 		Trailer:    res.Trailer,
 	}).WithContext(st.ctx)
 	rw := sc.newResponseWriter(st, req)
@@ -2244,11 +2254,12 @@
 	rw       *responseWriter
 	req      *http.Request
 	handler  func(http.ResponseWriter, *http.Request)
+	body     *pipe
 }
 
 // scheduleHandler starts a handler goroutine,
 // or schedules one to start as soon as an existing handler finishes.
-func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error {
+func (sc *serverConn) scheduleHandler(st *stream, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error {
 	sc.serveG.check()
 	maxHandlers := sc.advMaxStreams
 	if sc.curHandlers < maxHandlers {
@@ -2260,10 +2271,11 @@
 		return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm))
 	}
 	sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{
-		streamID: streamID,
+		streamID: st.id,
 		rw:       rw,
 		req:      req,
 		handler:  handler,
+		body:     st.body,
 	})
 	return nil
 }
@@ -2277,6 +2289,10 @@
 		u := sc.unstartedHandlers[i]
 		if sc.streams[u.streamID] == nil {
 			// This stream was reset before its goroutine had a chance to start.
+			if u.body != nil {
+				u.body.BreakWithError(errClosedBody)
+				sc.sendWindowUpdate(nil, u.body.Len())
+			}
 			continue
 		}
 		if sc.curHandlers >= maxHandlers {
@@ -2298,6 +2314,12 @@
 	didPanic := true
 	defer func() {
 		rw.rws.stream.cancelCtx()
+		if b := rw.rws.stream.reqBody; b != nil {
+			// Closing the body refunds flow control credit for any unconsumed data.
+			// (reqBody is nil for Upgrade: h2c requests, but those do not use flow
+			// control for the request body.)
+			b.Close()
+		}
 		if req.MultipartForm != nil {
 			req.MultipartForm.RemoveAll()
 		}
@@ -2396,7 +2418,7 @@
 func (sc *serverConn) noteBodyRead(st *stream, n int) {
 	sc.serveG.check()
 	sc.sendWindowUpdate(nil, n) // conn-level
-	if st.state != stateHalfClosedRemote && st.state != stateClosed {
+	if st != nil && st.state != stateHalfClosedRemote && st.state != stateClosed {
 		// Don't send this WINDOW_UPDATE if the stream is closed
 		// remotely.
 		sc.sendWindowUpdate(st, n)
@@ -2444,6 +2466,9 @@
 	b.closeOnce.Do(func() {
 		if b.pipe != nil {
 			b.pipe.BreakWithError(errClosedBody)
+			if unread := b.pipe.Len(); unread > 0 {
+				b.conn.noteBodyReadFromHandler(nil, unread, errClosedBody)
+			}
 		}
 	})
 	return nil
@@ -2461,9 +2486,6 @@
 	if err == io.EOF {
 		b.sawEOF = true
 	}
-	if b.conn == nil {
-		return
-	}
 	b.conn.noteBodyReadFromHandler(b.stream, n, err)
 	return
 }
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/net/http2/transport.go /work/src/external-snapshotter/vendor/golang.org/x/net/http2/transport.go
--- a/vendor/golang.org/x/net/http2/transport.go	2026-10-28 10:19:50.843179903 +0000
+++ b/vendor/golang.org/x/net/http2/transport.go	2026-10-28 10:20:23.450877695 +0000
@@ -27,6 +27,7 @@
 	"net/http"
 	"net/http/httptrace"
 	"net/textproto"
+	"slices"
 	"strconv"
 	"sync"
 	"sync/atomic"
@@ -203,7 +204,7 @@
 
 	mu               sync.Mutex // guards following
 	cond             *sync.Cond // hold mu; broadcast on flow/closed changes
-	flow             outflow    // our conn-level flow control quota (cs.outflow is per stream)
+	flow             connOutflow // our conn-level flow control quota (cs.outflow is per stream)
 	inflow           inflow     // peer's conn-level flow control
 	doNotReuse       bool       // whether conn is marked to not be reused for any future requests
 	closing          bool
@@ -227,7 +228,6 @@
 	maxConcurrentStreams        uint32
 	peerMaxHeaderListSize       uint64
 	peerMaxHeaderTableSize      uint32
-	initialWindowSize           uint32
 	initialStreamRecvWindowSize int32
 	readIdleTimeout             time.Duration
 	pingTimeout                 time.Duration
@@ -472,7 +472,6 @@
 		readerDone:                  make(chan struct{}),
 		nextStreamID:                1,
 		maxFrameSize:                16 << 10, // spec default
-		initialWindowSize:           65535,    // spec default
 		initialStreamRecvWindowSize: conf.MaxUploadBufferPerStream,
 		maxConcurrentStreams:        initialMaxConcurrentStreams, // "infinite", per spec. Use a smaller value until we have received server settings.
 		strictMaxConcurrentStreams:  conf.StrictMaxConcurrentRequests,
@@ -497,7 +496,7 @@
 	}
 
 	cc.cond = sync.NewCond(&cc.mu)
-	cc.flow.add(int32(initialWindowSize))
+	cc.flow.init()
 
 	// TODO: adjust this writer size to account for frame size +
 	// MTU + crypto/tls record padding.
@@ -876,6 +875,33 @@
 	return nil
 }
 
+func (cc *ClientConn) goAwayAndClose(code ErrCode) {
+	cc.mu.Lock()
+	closed := cc.closed
+	cc.closing = true
+	cc.closed = true
+	cc.mu.Unlock()
+	if closed {
+		return
+	}
+	if f := cc.fr.countError; f != nil {
+		f(fmt.Sprintf("conn_close_error_%s", code.stringToken()))
+	}
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		cc.wmu.Lock()
+		cc.fr.WriteGoAway(0, code, nil)
+		cc.bw.Flush()
+		cc.wmu.Unlock()
+	}()
+	select {
+	case <-done:
+	case <-time.After(250 * time.Millisecond):
+	}
+	cc.closeForError(fmt.Errorf("http2: closing connection with %v", code))
+}
+
 // closes the client connection immediately. In-flight requests are interrupted.
 // err is sent to streams.
 func (cc *ClientConn) closeForError(err error) {
@@ -1319,7 +1345,9 @@
 	}
 	if err != nil {
 		cs.abortStream(err) // possibly redundant, but harmless
-		if cs.sentHeaders {
+		if ce, ok := err.(ConnectionError); ok {
+			cc.goAwayAndClose(ErrCode(ce))
+		} else if cs.sentHeaders {
 			if se, ok := err.(StreamError); ok {
 				if se.Cause != errFromPeer {
 					cc.writeStreamReset(cs.ID, se.Code, false, err)
@@ -1648,8 +1676,12 @@
 			return 0, errRequestCanceled
 		default:
 		}
-		if a := cs.flow.available(); a > 0 {
-			take := a
+		avail, ok := cs.flow.available()
+		if !ok {
+			return 0, ConnectionError(ErrCodeFlowControl)
+		}
+		if avail > 0 {
+			take := avail
 			if int(take) > maxBytes {
 
 				take = int32(maxBytes) // can't truncate int; take is int32
@@ -1710,8 +1742,7 @@
 
 // requires cc.mu be held.
 func (cc *ClientConn) addStreamLocked(cs *clientStream) {
-	cs.flow.add(int32(cc.initialWindowSize))
-	cs.flow.setConnFlow(&cc.flow)
+	cs.flow.conn = &cc.flow
 	cs.inflow.init(cc.initialStreamRecvWindowSize)
 	cs.ID = cc.nextStreamID
 	cc.nextStreamID += 2
@@ -2095,18 +2126,42 @@
 		return nil, nil
 	}
 
+	// Delete various headers that might mess up framing for HTTP/1. This is
+	// not a problem for HTTP/2, but someone might use HTTP/2 transport as a
+	// reverse proxy which forwards the response to an HTTP/1 client. Our
+	// HTTP/1 client transport will properly reject improper headers such as
+	// multiple conflicting Content-Length headers, but other implementations
+	// might not.
+	// TODO: just reject such responses? We deleted them for compatibility
+	// since this was done in a security fix (go.dev/issue/81115). However,
+	// rejecting them seems entirely reasonable and relatively safe.
+
+	// Connection-specific header fields must not appear in an HTTP/2 message,
+	// and any message containing them is malformed. RFC 9113, Section 8.2.2.
+	for _, k := range connHeaders {
+		delete(res.Header, k)
+	}
 	res.ContentLength = -1
-	if clens := res.Header["Content-Length"]; len(clens) == 1 {
-		if cl, err := strconv.ParseUint(clens[0], 10, 63); err == nil {
-			res.ContentLength = int64(cl)
+	if clens, ok := res.Header["Content-Length"]; ok {
+		// Repeated Content-Length values may be collapsed into one only if
+		// they are identical per RFC 9110 Section 8.6.
+		// No need to trim whitespace, HTTP/2 header values must not have
+		// extraneous whitespace per RFC 9113 Section 8.2.1.
+		// Non-canonical headers are already rejected by our framer at this
+		// point.
+		conflicting := slices.ContainsFunc(clens[1:], func(clen string) bool {
+			return clen != clens[0]
+		})
+		cl, err := strconv.ParseUint(clens[0], 10, 63)
+		if conflicting || err != nil {
+			delete(res.Header, "Content-Length")
 		} else {
-			// TODO: care? unlike http/1, it won't mess up our framing, so it's
-			// more safe smuggling-wise to ignore.
+			res.Header["Content-Length"] = clens[:1]
+			res.ContentLength = int64(cl)
 		}
-	} else if len(clens) > 1 {
-		// TODO: care? unlike http/1, it won't mess up our framing, so it's
-		// more safe smuggling-wise to ignore.
-	} else if f.StreamEnded() && !cs.isHead {
+	}
+
+	if res.ContentLength < 0 && f.StreamEnded() && !cs.isHead {
 		res.ContentLength = 0
 	}
 
@@ -2417,6 +2472,10 @@
 func (rl *clientConnReadLoop) streamByID(id uint32, headerOrData bool) *clientStream {
 	rl.cc.mu.Lock()
 	defer rl.cc.mu.Unlock()
+	return rl.streamByIDLocked(id, headerOrData)
+}
+
+func (rl *clientConnReadLoop) streamByIDLocked(id uint32, headerOrData bool) *clientStream {
 	if headerOrData {
 		// Work around an unfortunate gRPC behavior.
 		// See comment on ClientConn.rstStreamPingsBlocked for details.
@@ -2499,24 +2558,10 @@
 		case SettingMaxHeaderListSize:
 			cc.peerMaxHeaderListSize = uint64(s.Val)
 		case SettingInitialWindowSize:
-			// Values above the maximum flow-control
-			// window size of 2^31-1 MUST be treated as a
-			// connection error (Section 5.4.1) of type
-			// FLOW_CONTROL_ERROR.
-			if s.Val > math.MaxInt32 {
+			if !cc.flow.changeInitialWindowSize(int64(s.Val)) {
 				return ConnectionError(ErrCodeFlowControl)
 			}
-
-			// Adjust flow control of currently-open
-			// frames by the difference of the old initial
-			// window size and this one.
-			delta := int32(s.Val) - int32(cc.initialWindowSize)
-			for _, cs := range cc.streams {
-				cs.flow.add(delta)
-			}
 			cc.cond.Broadcast()
-
-			cc.initialWindowSize = s.Val
 		case SettingHeaderTableSize:
 			cc.henc.SetMaxDynamicTableSize(s.Val)
 			cc.peerMaxHeaderTableSize = s.Val
@@ -2558,29 +2603,30 @@
 
 func (rl *clientConnReadLoop) processWindowUpdate(f *WindowUpdateFrame) error {
 	cc := rl.cc
-	cs := rl.streamByID(f.StreamID, notHeaderOrDataFrame)
-	if f.StreamID != 0 && cs == nil {
-		return nil
-	}
-
 	cc.mu.Lock()
 	defer cc.mu.Unlock()
-
-	fl := &cc.flow
-	if cs != nil {
-		fl = &cs.flow
-	}
-	if !fl.add(int32(f.Increment)) {
-		// For stream, the sender sends RST_STREAM with an error code of FLOW_CONTROL_ERROR
-		if cs != nil {
+	if f.StreamID == 0 {
+		if !cc.flow.add(int32(f.Increment)) {
+			return ConnectionError(ErrCodeFlowControl)
+		}
+	} else {
+		cs := rl.streamByIDLocked(f.StreamID, notHeaderOrDataFrame)
+		if cs == nil {
+			return nil
+		}
+		if !cs.flow.add(int32(f.Increment)) {
+			if cs.flow.conn.flowErr {
+				// This is a lazily-detected connection-level flow control error.
+				return ConnectionError(ErrCodeFlowControl)
+			}
+			// For stream, the sender sends RST_STREAM with
+			// an error code of FLOW_CONTROL_ERROR.
 			rl.endStreamErrorLocked(cs, StreamError{
 				StreamID: f.StreamID,
 				Code:     ErrCodeFlowControl,
 			})
 			return nil
 		}
-
-		return ConnectionError(ErrCodeFlowControl)
 	}
 	cc.cond.Broadcast()
 	return nil
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/net/http2/transport_wrap.go /work/src/external-snapshotter/vendor/golang.org/x/net/http2/transport_wrap.go
--- a/vendor/golang.org/x/net/http2/transport_wrap.go	2026-10-28 10:19:50.843179903 +0000
+++ b/vendor/golang.org/x/net/http2/transport_wrap.go	2026-10-28 10:20:23.450877695 +0000
@@ -119,33 +119,27 @@
 
 // DialFromContext dials a new connection using the http2.Transport's DialTLS/DialTLSContext.
 func (t transportConfig) DialFromContext(ctx context.Context, network, address string) (net.Conn, error) {
-	if ctx.Value(http2TransportContextKey{}) == nil {
+	dial, _ := ctx.Value(http2TransportContextKey{}).(*transportRoundTripState)
+	if dial == nil {
 		// We're being called from a RoundTrip that did not start with an http2.Transport.
 		// Use the http.Transport's dialer.
 		return nil, errors.ErrUnsupported
 	}
-
-	tlsConf := t.t.TLSClientConfig
-	if tlsConf == nil {
-		tlsConf = &tls.Config{}
-	} else {
-		tlsConf = tlsConf.Clone()
-	}
-	if !slices.Contains(tlsConf.NextProtos, "h2") {
-		tlsConf.NextProtos = append([]string{"h2"}, tlsConf.NextProtos...)
-	}
-	if tlsConf.ServerName == "" {
-		host, _, err := net.SplitHostPort(address)
-		if err == nil {
-			tlsConf.ServerName = host
-		}
-	}
-	return t.t.dialTLS(ctx, network, address, tlsConf)
+	return t.t.dialForRoundTrip(ctx, dial, network, address)
 }
 
 type transportInternal struct {
 	initOnce sync.Once
 	lazyt1   *http.Transport
+
+	dialMu sync.Mutex
+	dials  map[string]*transportDialState
+}
+
+type transportDialState struct {
+	dialc   chan struct{} // close when dial returns
+	dialErr error         // dial result, set before dialc is closed
+	rtdonec chan struct{} // closed when RoundTrip initiating the dial returns
 }
 
 func (t *Transport) init() *http.Transport {
@@ -167,6 +161,52 @@
 	}
 }
 
+// transportRoundTripState is the state of the dial for an http2.Transport.RoundTrip.
+type transportRoundTripState struct {
+	mu       sync.Mutex
+	rtdone   bool          // set when RoundTrip returns
+	rtdonec  chan struct{} // closed when RoundTrip returns
+	gotconnc chan struct{} // closed when GotConn hook is called
+}
+
+// startDial is called when a dial starts.
+//
+// It returns done=true if the RoundTrip has already returned,
+// in which case we should skip dialing.
+func (dial *transportRoundTripState) startDial() (gotconnc chan struct{}, done bool) {
+	dial.mu.Lock()
+	defer dial.mu.Unlock()
+	if dial.rtdone {
+		return nil, true
+	}
+	if dial.rtdonec == nil {
+		dial.rtdonec = make(chan struct{})
+	}
+	dial.gotconnc = make(chan struct{})
+	return dial.gotconnc, false
+}
+
+// gotConn is called when RoundTrip gets a connection.
+// This may happen multiple times per RoundTrip, if a request is retried.
+func (dial *transportRoundTripState) gotConn() {
+	dial.mu.Lock()
+	defer dial.mu.Unlock()
+	if dial.gotconnc != nil {
+		close(dial.gotconnc)
+		dial.gotconnc = nil
+	}
+}
+
+// roundTripDone is called when RoundTrip returns.
+func (dial *transportRoundTripState) roundTripDone() {
+	dial.mu.Lock()
+	defer dial.mu.Unlock()
+	dial.rtdone = true
+	if dial.rtdonec != nil {
+		close(dial.rtdonec)
+	}
+}
+
 func (t *Transport) roundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Response, error) {
 	t1 := t.init()
 
@@ -186,12 +226,146 @@
 	// Both http.Transport and http2.Transport allow the user to provide a custom
 	// dial function, and historically you only get the dial function from the
 	// Transport you're calling RoundTrip on.
-	ctx := context.WithValue(req.Context(), http2TransportContextKey{}, t)
+	//
+	// In addition, http2.Transport coalesces dials, which http.Transport historically
+	// has not.
+	dial := &transportRoundTripState{}
+	defer dial.roundTripDone()
+	ctx := context.WithValue(req.Context(), http2TransportContextKey{}, dial)
+	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
+		GotConn: func(httptrace.GotConnInfo) {
+			// Tell dialForRoundTrip that we have received a connection.
+			dial.gotConn()
+		},
+	})
 	req = req.WithContext(ctx)
-
 	return t1.RoundTrip(req)
 }
 
+var errCoalescedDialAbandoned = errors.New("http2: abandoned coalesced dial")
+
+const coalescedDialRetryTimeout = 50 * time.Millisecond
+
+// dialForRoundTrip is called (indirectly) by net/http when dialing a new connection
+// for a request call which originated as an http2.Transport.RoundTrip call.
+//
+// It uses the http2.Transport's Dial hooks and coalesces dials.
+func (t *Transport) dialForRoundTrip(ctx context.Context, dial *transportRoundTripState, network, address string) (net.Conn, error) {
+	gotconnc, rtdone := dial.startDial()
+	if rtdone {
+		// RoundTrip returned, no need for this dial to proceed.
+		return nil, errCoalescedDialAbandoned
+	}
+
+	var state *transportDialState
+	for {
+		// The first dial to an address registers itself with t.dials.
+		// When the dial finishes, it records the outcome and removes itself from t.dials
+		// so future dials will start a new round of coalescing.
+		//
+		// Subsequent dials observe that a dial is in progress, and skip dialing.
+		t.dialMu.Lock()
+		if t.dials == nil {
+			t.dials = make(map[string]*transportDialState)
+		}
+		leader := t.dials[address]
+		if leader == nil {
+			// No entry in t.dials to coalesce with. Add ourselves as leader.
+			state = &transportDialState{
+				dialc:   make(chan struct{}),
+				rtdonec: dial.rtdonec,
+			}
+			t.dials[address] = state
+		}
+		t.dialMu.Unlock()
+		if leader == nil {
+			// We are the leader, so we should dial for real.
+			break
+		}
+
+		// Coalesce with a previous dial.
+		var (
+			done          = false
+			leaderdialc   = leader.dialc
+			leaderrtdonec = leader.rtdonec
+			timerc        <-chan time.Time
+		)
+		for !done {
+			if leaderdialc == nil && leaderrtdonec == nil && timerc == nil {
+				// The leader finished dialing, and its RoundTrip finished.
+				//
+				// There are several possibilities, which reduce to:
+				//   - The RoundTrip we are dialing for is about to receive
+				//     a connection (possibly the one the leader just dialed),
+				//     but we haven't observed it yet.
+				//   - There's something wrong with the leader's connection,
+				//     such as a TLS handshake failure.
+				//
+				// We have no good way to distinguish between these cases.
+				//
+				// Wait a short time for the leader's connection (or some
+				// other usable connection) to be delivered to our RoundTrip.
+				// If it is not, start a dial of our own.
+				timerc = time.After(coalescedDialRetryTimeout)
+			}
+			select {
+			case <-leaderdialc:
+				// The leader's dial completed.
+				if leader.dialErr != nil {
+					return nil, leader.dialErr
+				}
+				leaderdialc = nil
+			case <-leaderrtdonec:
+				// The leader's RoundTrip completed.
+				leaderrtdonec = nil
+			case <-timerc:
+				// The leader's dial and RoundTrip completed, and some time
+				// has passed. Assume we're not getting a connection and
+				// restart the dial process.
+				done = true
+			case <-dial.rtdonec:
+				// Our RoundTrip returned.
+				return nil, errCoalescedDialAbandoned
+			case <-gotconnc:
+				// Our RoundTrip got a connection.
+				return nil, errCoalescedDialAbandoned
+			case <-ctx.Done():
+				// net/http abandoned the dial.
+				return nil, ctx.Err()
+			}
+		}
+	}
+
+	// Dial for real.
+	tlsConf := t.TLSClientConfig
+	if tlsConf == nil {
+		tlsConf = &tls.Config{}
+	} else {
+		tlsConf = tlsConf.Clone()
+	}
+	if !slices.Contains(tlsConf.NextProtos, "h2") {
+		tlsConf.NextProtos = append([]string{"h2"}, tlsConf.NextProtos...)
+	}
+	if tlsConf.ServerName == "" {
+		host, _, err := net.SplitHostPort(address)
+		if err == nil {
+			tlsConf.ServerName = host
+		}
+	}
+	nc, err := t.dialTLS(ctx, network, address, tlsConf)
+
+	// Remove this dial from t.dials, so future dial attempts will not coalesce with it.
+	t.dialMu.Lock()
+	delete(t.dials, address)
+	t.dialMu.Unlock()
+
+	// Notify any dial coalesced with this one that we are done.
+	state.dialErr = err
+	close(state.dialc)
+
+	return nc, err
+}
+
 func (t *Transport) closeIdleConnections() {
 	t1 := t.init()
 	t1.CloseIdleConnections()
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/net/http2/writesched.go /work/src/external-snapshotter/vendor/golang.org/x/net/http2/writesched.go
--- a/vendor/golang.org/x/net/http2/writesched.go	2026-10-28 10:19:50.843179903 +0000
+++ b/vendor/golang.org/x/net/http2/writesched.go	2026-10-28 10:20:23.450877695 +0000
@@ -79,10 +79,11 @@
 	}
 
 	// Might need to split after applying limits.
-	allowed := wr.stream.flow.available()
-	if n < allowed {
-		allowed = n
+	avail, ok := wr.stream.flow.available()
+	if !ok {
+		return empty, empty, 0
 	}
+	allowed := min(n, avail)
 	if wr.stream.sc.maxFrameSize < allowed {
 		allowed = wr.stream.sc.maxFrameSize
 	}
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/net/internal/httpcommon/gzip.go /work/src/external-snapshotter/vendor/golang.org/x/net/internal/httpcommon/gzip.go
--- a/vendor/golang.org/x/net/internal/httpcommon/gzip.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/net/internal/httpcommon/gzip.go	2026-10-28 10:20:23.458877618 +0000
@@ -0,0 +1,132 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package httpcommon
+
+import (
+	"compress/flate"
+	"compress/gzip"
+	"errors"
+	"io"
+	"io/fs"
+	"sync"
+)
+
+var errConcurrentRead = errors.New("http: concurrent read on response body")
+
+// incomparable is a zero-width, non-comparable type. Adding it to a struct
+// makes that struct also non-comparable, and generally doesn't add
+// any size (as long as it's first).
+type incomparable [0]func()
+
+// GzipReader wraps a response body so it can lazily
+// get gzip.Reader from the pool on the first call to Read.
+// After Close is called it puts gzip.Reader to the pool immediately
+// if there is no Read in progress or later when Read completes.
+type GzipReader struct {
+	_    incomparable
+	Body io.ReadCloser // underlying Response.Body
+	mu   sync.Mutex    // guards zr and zerr
+	zr   *gzip.Reader  // stores gzip reader from the pool between reads
+	zerr error         // sticky gzip reader init error or sentinel value to detect concurrent read and read after close
+}
+
+type eofReader struct{}
+
+func (eofReader) Read([]byte) (int, error) { return 0, io.EOF }
+func (eofReader) ReadByte() (byte, error)  { return 0, io.EOF }
+
+var gzipPool = sync.Pool{New: func() any { return new(gzip.Reader) }}
+
+// gzipPoolGet gets a gzip.Reader from the pool and resets it to read from r.
+func gzipPoolGet(r io.Reader) (*gzip.Reader, error) {
+	zr := gzipPool.Get().(*gzip.Reader)
+	if err := zr.Reset(r); err != nil {
+		gzipPoolPut(zr)
+		return nil, err
+	}
+	return zr, nil
+}
+
+// gzipPoolPut puts a gzip.Reader back into the pool.
+func gzipPoolPut(zr *gzip.Reader) {
+	// Reset will allocate bufio.Reader if we pass it anything
+	// other than a flate.Reader, so ensure that it's getting one.
+	var r flate.Reader = eofReader{}
+	zr.Reset(r)
+	gzipPool.Put(zr)
+}
+
+// acquire returns a gzip.Reader for reading response body.
+// The reader must be released after use.
+func (gz *GzipReader) acquire() (*gzip.Reader, error) {
+	gz.mu.Lock()
+	defer gz.mu.Unlock()
+	if gz.zerr != nil {
+		return nil, gz.zerr
+	}
+	if gz.zr == nil {
+		// gzipPoolGet might block indefinitely since it reads the gzip header.
+		// Therefore, drop mu temporarily when using gzipPoolGet.
+		// We set zerr to errConcurrentRead to prevent concurrent read
+		// even when mu is temporarily dropped.
+		gz.zerr = errConcurrentRead
+		gz.mu.Unlock()
+		zr, err := gzipPoolGet(gz.Body)
+		gz.mu.Lock()
+		// Guard against Close being called while gzipPoolGet is running.
+		if gz.zerr != errConcurrentRead {
+			if zr != nil {
+				gzipPoolPut(zr)
+			}
+			return nil, gz.zerr
+		}
+		gz.zr, gz.zerr = zr, err
+		if gz.zerr != nil {
+			return nil, gz.zerr
+		}
+	}
+	ret := gz.zr
+	gz.zr, gz.zerr = nil, errConcurrentRead
+	return ret, nil
+}
+
+// release returns the gzip.Reader to the pool if Close was called during Read.
+func (gz *GzipReader) release(zr *gzip.Reader) {
+	gz.mu.Lock()
+	defer gz.mu.Unlock()
+	if gz.zerr == errConcurrentRead {
+		gz.zr, gz.zerr = zr, nil
+	} else { // fs.ErrClosed
+		gzipPoolPut(zr)
+	}
+}
+
+// close returns the gzip.Reader to the pool immediately or
+// signals release to do so after Read completes.
+func (gz *GzipReader) close() {
+	gz.mu.Lock()
+	defer gz.mu.Unlock()
+	if gz.zerr == nil && gz.zr != nil {
+		gzipPoolPut(gz.zr)
+		gz.zr = nil
+	}
+	gz.zerr = fs.ErrClosed
+}
+
+func (gz *GzipReader) Read(p []byte) (n int, err error) {
+	zr, err := gz.acquire()
+	if err != nil {
+		return 0, err
+	}
+	defer gz.release(zr)
+
+	return zr.Read(p)
+}
+
+func (gz *GzipReader) Close() error {
+	gz.close()
+
+	return gz.Body.Close()
+}
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/asm_linux_ppc64x.s /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/asm_linux_ppc64x.s
--- a/vendor/golang.org/x/sys/unix/asm_linux_ppc64x.s	2026-10-28 10:19:50.847179863 +0000
+++ b/vendor/golang.org/x/sys/unix/asm_linux_ppc64x.s	2026-10-28 10:20:23.638875887 +0000
@@ -13,6 +13,16 @@
 // Just jump to package syscall's implementation for all these functions.
 // The runtime may know about them.
 
+TEXT ·Syscall(SB),NOSPLIT,$0-56
+	MOVD	$syscall·Syscall(SB), R31
+	MOVD	R31, CTR
+	JMP	(CTR)
+
+TEXT ·Syscall6(SB),NOSPLIT,$0-80
+	MOVD	$syscall·Syscall6(SB), R31
+	MOVD	R31, CTR
+	JMP	(CTR)
+
 TEXT ·SyscallNoError(SB),NOSPLIT,$0-48
 	BL	runtime·entersyscall(SB)
 	MOVD	a1+8(FP), R3
@@ -28,6 +38,16 @@
 	BL	runtime·exitsyscall(SB)
 	RET
 
+TEXT ·RawSyscall(SB),NOSPLIT,$0-56
+	MOVD	$syscall·RawSyscall(SB), R31
+	MOVD	R31, CTR
+	JMP	(CTR)
+
+TEXT ·RawSyscall6(SB),NOSPLIT,$0-80
+	MOVD	$syscall·RawSyscall6(SB), R31
+	MOVD	R31, CTR
+	JMP	(CTR)
+
 TEXT ·RawSyscallNoError(SB),NOSPLIT,$0-48
 	MOVD	a1+8(FP), R3
 	MOVD	a2+16(FP), R4
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/asm_linux_sparc64.s /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/asm_linux_sparc64.s
--- a/vendor/golang.org/x/sys/unix/asm_linux_sparc64.s	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/sys/unix/asm_linux_sparc64.s	2026-10-28 10:20:23.638875887 +0000
@@ -0,0 +1,48 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && sparc64 && gc
+
+#include "textflag.h"
+
+//
+// System calls for sparc64, Linux
+//
+
+// Just jump to package syscall's implementation for all these functions.
+// The runtime may know about them.
+
+TEXT ·Syscall(SB), NOSPLIT, $0-56
+	JMP	syscall·Syscall(SB)
+
+TEXT ·Syscall6(SB), NOSPLIT, $0-80
+	JMP	syscall·Syscall6(SB)
+
+TEXT ·SyscallNoError(SB), NOSPLIT, $0-48
+	CALL	runtime·entersyscall(SB)
+	MOVD	trap+0(FP), R1	// syscall entry
+	MOVD	a1+8(FP), R8
+	MOVD	a2+16(FP), R9
+	MOVD	a3+24(FP), R10
+	TA	$0x6d
+	MOVD	R8, r1+32(FP)
+	MOVD	R9, r2+40(FP)
+	CALL	runtime·exitsyscall(SB)
+	RET
+
+TEXT ·RawSyscall(SB), NOSPLIT, $0-56
+	JMP	syscall·RawSyscall(SB)
+
+TEXT ·RawSyscall6(SB), NOSPLIT, $0-80
+	JMP	syscall·RawSyscall6(SB)
+
+TEXT ·RawSyscallNoError(SB), NOSPLIT, $0-48
+	MOVD	trap+0(FP), R1	// syscall entry
+	MOVD	a1+8(FP), R8
+	MOVD	a2+16(FP), R9
+	MOVD	a3+24(FP), R10
+	TA	$0x6d
+	MOVD	R8, r1+32(FP)
+	MOVD	R9, r2+40(FP)
+	RET
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/asm_zos_s390x.s /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/asm_zos_s390x.s
--- a/vendor/golang.org/x/sys/unix/asm_zos_s390x.s	2026-10-28 10:19:50.847179863 +0000
+++ b/vendor/golang.org/x/sys/unix/asm_zos_s390x.s	2026-10-28 10:20:23.638875887 +0000
@@ -30,21 +30,8 @@
 #define SVC_LOAD   BYTE $0x0A; BYTE $0x08 // SVC 08 LOAD
 #define SVC_DELETE BYTE $0x0A; BYTE $0x09 // SVC 09 DELETE
 
-DATA zosLibVec<>(SB)/8, $0
-GLOBL zosLibVec<>(SB), NOPTR, $8
-
-TEXT ·initZosLibVec(SB), NOSPLIT|NOFRAME, $0-0
-	MOVW PSALAA, R8
-	MOVD LCA64(R8), R8
-	MOVD CAA(R8), R8
-	MOVD EDCHPXV(R8), R8
-	MOVD R8, zosLibVec<>(SB)
-	RET
-
 TEXT ·GetZosLibVec(SB), NOSPLIT|NOFRAME, $0-0
-	MOVD zosLibVec<>(SB), R8
-	MOVD R8, ret+0(FP)
-	RET
+	JMP  runtime·GetZosLibVec(SB)
 
 TEXT ·clearErrno(SB), NOSPLIT, $0-0
 	BL   addrerrno<>(SB)
@@ -160,163 +147,13 @@
 // errno and errno2 is retrieved
 //
 TEXT ·CallLeFuncWithErr(SB), NOSPLIT, $0
-	MOVW PSALAA, R8
-	MOVD LCA64(R8), R8
-	MOVD CAA(R8), R9
-	MOVD g, GOCB(R9)
-
-	// Restore LE stack.
-	MOVD SAVSTACK_ASYNC(R8), R9 // R9-> LE stack frame saving address
-	MOVD 0(R9), R4              // R4-> restore previously saved stack frame pointer
-
-	MOVD parms_base+8(FP), R7 // R7 -> argument array
-	MOVD parms_len+16(FP), R8 // R8 number of arguments
-
-	//  arg 1 ---> R1
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	MOVD 0(R7), R1
-
-	//  arg 2 ---> R2
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	ADD  $8, R7
-	MOVD 0(R7), R2
-
-	//  arg 3 --> R3
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	ADD  $8, R7
-	MOVD 0(R7), R3
-
-	CMP  R8, $0
-	BEQ  docall
-	MOVD $2176+16, R6 // starting LE stack address-8 to store 4th argument
-
-repeat:
-	ADD  $8, R7
-	MOVD 0(R7), R0      // advance arg pointer by 8 byte
-	ADD  $8, R6         // advance LE argument address by 8 byte
-	MOVD R0, (R4)(R6*1) // copy argument from go-slice to le-frame
-	SUB  $1, R8
-	CMP  R8, $0
-	BNE  repeat
-
-docall:
-	MOVD funcdesc+0(FP), R8 // R8-> function descriptor
-	LMG  0(R8), R5, R6
-	MOVD $0, 0(R9)          // R9 address of SAVSTACK_ASYNC
-	LE_CALL                 // balr R7, R6 (return #1)
-	NOPH
-	MOVD R3, ret+32(FP)
-	CMP  R3, $-1            // compare result to -1
-	BNE  done
-
-	// retrieve errno and errno2
-	MOVD  zosLibVec<>(SB), R8
-	ADD   $(__errno), R8
-	LMG   0(R8), R5, R6
-	LE_CALL                   // balr R7, R6 __errno (return #3)
-	NOPH
-	MOVWZ 0(R3), R3
-	MOVD  R3, err+48(FP)
-	MOVD  zosLibVec<>(SB), R8
-	ADD   $(__err2ad), R8
-	LMG   0(R8), R5, R6
-	LE_CALL                   // balr R7, R6 __err2ad (return #2)
-	NOPH
-	MOVW  (R3), R2            // retrieve errno2
-	MOVD  R2, errno2+40(FP)   // store in return area
-
-done:
-	MOVD R4, 0(R9)            // Save stack pointer.
-	RET
-
+        JMP  runtime·CallLeFuncWithErr(SB)
 //
 // Call LE function, if the return is 0
 // errno and errno2 is retrieved
 //
 TEXT ·CallLeFuncWithPtrReturn(SB), NOSPLIT, $0
-	MOVW PSALAA, R8
-	MOVD LCA64(R8), R8
-	MOVD CAA(R8), R9
-	MOVD g, GOCB(R9)
-
-	// Restore LE stack.
-	MOVD SAVSTACK_ASYNC(R8), R9 // R9-> LE stack frame saving address
-	MOVD 0(R9), R4              // R4-> restore previously saved stack frame pointer
-
-	MOVD parms_base+8(FP), R7 // R7 -> argument array
-	MOVD parms_len+16(FP), R8 // R8 number of arguments
-
-	//  arg 1 ---> R1
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	MOVD 0(R7), R1
-
-	//  arg 2 ---> R2
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	ADD  $8, R7
-	MOVD 0(R7), R2
-
-	//  arg 3 --> R3
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	ADD  $8, R7
-	MOVD 0(R7), R3
-
-	CMP  R8, $0
-	BEQ  docall
-	MOVD $2176+16, R6 // starting LE stack address-8 to store 4th argument
-
-repeat:
-	ADD  $8, R7
-	MOVD 0(R7), R0      // advance arg pointer by 8 byte
-	ADD  $8, R6         // advance LE argument address by 8 byte
-	MOVD R0, (R4)(R6*1) // copy argument from go-slice to le-frame
-	SUB  $1, R8
-	CMP  R8, $0
-	BNE  repeat
-
-docall:
-	MOVD funcdesc+0(FP), R8 // R8-> function descriptor
-	LMG  0(R8), R5, R6
-	MOVD $0, 0(R9)          // R9 address of SAVSTACK_ASYNC
-	LE_CALL                 // balr R7, R6 (return #1)
-	NOPH
-	MOVD R3, ret+32(FP)
-	CMP  R3, $0             // compare result to 0
-	BNE  done
-
-	// retrieve errno and errno2
-	MOVD  zosLibVec<>(SB), R8
-	ADD   $(__errno), R8
-	LMG   0(R8), R5, R6
-	LE_CALL                   // balr R7, R6 __errno (return #3)
-	NOPH
-	MOVWZ 0(R3), R3
-	MOVD  R3, err+48(FP)
-	MOVD  zosLibVec<>(SB), R8
-	ADD   $(__err2ad), R8
-	LMG   0(R8), R5, R6
-	LE_CALL                   // balr R7, R6 __err2ad (return #2)
-	NOPH
-	MOVW  (R3), R2            // retrieve errno2
-	MOVD  R2, errno2+40(FP)   // store in return area
-	XOR   R2, R2
-	MOVWZ R2, (R3)            // clear errno2
-
-done:
-	MOVD R4, 0(R9)            // Save stack pointer.
-	RET
-
+        JMP runtime·CallLeFuncWithPtrReturn(SB)
 //
 // function to test if a pointer can be safely dereferenced (content read)
 // return 0 for succces
@@ -360,23 +197,4 @@
 //
 // func safeload(ptr uintptr) ( value uintptr, error uintptr)
 TEXT ·safeload(SB), NOSPLIT, $0-24
-	MOVD ptr+0(FP), R10                                                    // test pointer in R10
-	MOVD $0x0, R6
-	BYTE $0xE3; BYTE $0x20; BYTE $0x04; BYTE $0xB8; BYTE $0x00; BYTE $0x17 // llgt  2,1208
-	BYTE $0xB9; BYTE $0x17; BYTE $0x00; BYTE $0x22                         // llgtr 2,2
-	BYTE $0xA5; BYTE $0x26; BYTE $0x7F; BYTE $0xFF                         // nilh  2,32767
-	BYTE $0xE3; BYTE $0x22; BYTE $0x00; BYTE $0x58; BYTE $0x00; BYTE $0x04 // lg    2,88(2)
-	BYTE $0xE3; BYTE $0x22; BYTE $0x00; BYTE $0x08; BYTE $0x00; BYTE $0x04 // lg    2,8(2)
-	BYTE $0x41; BYTE $0x22; BYTE $0x03; BYTE $0x68                         // la    2,872(2)
-	BYTE $0xB9; BYTE $0x82; BYTE $0x00; BYTE $0x33                         // xgr   3,3
-	BYTE $0xA7; BYTE $0x55; BYTE $0x00; BYTE $0x04                         // bras  5,lbl1
-	BYTE $0xA7; BYTE $0x39; BYTE $0x00; BYTE $0x01                         // lghi  3,1
-	BYTE $0xB9; BYTE $0x02; BYTE $0x00; BYTE $0x33                         // lbl1     ltgr  3,3
-	BYTE $0xA7; BYTE $0x74; BYTE $0x00; BYTE $0x08                         // brc   b'0111',lbl2
-	BYTE $0xE3; BYTE $0x52; BYTE $0x00; BYTE $0x00; BYTE $0x00; BYTE $0x24 // stg 5,0(2)
-	BYTE $0xE3; BYTE $0x6A; BYTE $0x00; BYTE $0x00; BYTE $0x00; BYTE $0x04 // lg    6,0(10)
-	BYTE $0xB9; BYTE $0x82; BYTE $0x00; BYTE $0x99                         // lbl2     xgr   9,9
-	BYTE $0xE3; BYTE $0x92; BYTE $0x00; BYTE $0x00; BYTE $0x00; BYTE $0x24 // stg   9,0(2)
-	MOVD R6, value+8(FP)                                                   // result in R6
-	MOVD R3, error+16(FP)                                                  // error in R3
-	RET
+        JMP  runtime·ZosSafeLoad(SB)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/bpxsvc_zos.s /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/bpxsvc_zos.s
--- a/vendor/golang.org/x/sys/unix/bpxsvc_zos.s	2026-10-28 10:19:50.847179863 +0000
+++ b/vendor/golang.org/x/sys/unix/bpxsvc_zos.s	2026-10-28 10:20:23.638875887 +0000
@@ -20,15 +20,15 @@
 	MOVD  plist_base+0(FP), R1  // r1 points to plist
 	MOVD  bpx_offset+24(FP), R2 // r2 offset to BPX vector table
 	MOVD  R14, R7               // save r14
-	MOVD  R15, R8               // save r15
-	MOVWZ 16(R0), R9
-	MOVWZ 544(R9), R9
-	MOVWZ 24(R9), R9            // call vector in r9
-	ADD   R2, R9                // add offset to vector table
-	MOVWZ (R9), R9              // r9 points to entry point
-	BYTE  $0x0D                 // BL R14,R9 --> basr r14,r9
-	BYTE  $0xE9                 // clobbers 0,1,14,15
-	MOVD  R8, R15               // restore 15
+	MOVD  R15, R9               // save r15
+	MOVWZ 16(R0), R15
+	MOVWZ 544(R15), R15
+	MOVWZ 24(R15), R15          // call vector in r15
+	ADD   R2, R15               // add offset to vector table
+	MOVWZ (R15), R15            // r15 points to entry point
+	BYTE  $0x0D                 // BL R14,R15 --> basr r14,r15
+	BYTE  $0xEF                 // clobbers 0,1,14,15
+	MOVD  R9, R15               // restore 15
 	JMP   R7                    // return via saved return address
 
 //   func A2e(arr [] byte)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/fcntl_darwin.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/fcntl_darwin.go
--- a/vendor/golang.org/x/sys/unix/fcntl_darwin.go	2026-10-28 10:19:50.847179863 +0000
+++ b/vendor/golang.org/x/sys/unix/fcntl_darwin.go	2026-10-28 10:20:23.642875849 +0000
@@ -13,12 +13,12 @@
 
 // FcntlFlock performs a fcntl syscall for the F_GETLK, F_SETLK or F_SETLKW command.
 func FcntlFlock(fd uintptr, cmd int, lk *Flock_t) error {
-	_, err := fcntl(int(fd), cmd, int(uintptr(unsafe.Pointer(lk))))
+	_, err := fcntlPtr(int(fd), cmd, unsafe.Pointer(lk))
 	return err
 }
 
 // FcntlFstore performs a fcntl syscall for the F_PREALLOCATE command.
 func FcntlFstore(fd uintptr, cmd int, fstore *Fstore_t) error {
-	_, err := fcntl(int(fd), cmd, int(uintptr(unsafe.Pointer(fstore))))
+	_, err := fcntlPtr(int(fd), cmd, unsafe.Pointer(fstore))
 	return err
 }
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/mkerrors.sh /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/mkerrors.sh
--- a/vendor/golang.org/x/sys/unix/mkerrors.sh	2026-10-28 10:19:50.851179824 +0000
+++ b/vendor/golang.org/x/sys/unix/mkerrors.sh	2026-10-28 10:20:23.642875849 +0000
@@ -579,7 +579,7 @@
 		$2 ~ /^DIOC/ ||
 		$2 ~ /^RUSAGE_(SELF|CHILDREN|THREAD)/ ||
 		$2 ~ /^RLIMIT_(AS|CORE|CPU|DATA|FSIZE|LOCKS|MEMLOCK|MSGQUEUE|NICE|NOFILE|NPROC|RSS|RTPRIO|RTTIME|SIGPENDING|STACK)|RLIM_INFINITY/ ||
-		$2 ~ /^PRIO_(PROCESS|PGRP|USER)/ ||
+		$2 ~ /^PRIO_(PROCESS|PGRP|USER|DARWIN_(THREAD|PROCESS|BG|NONUI))/ ||
 		$2 ~ /^CLONE_[A-Z_]+/ ||
 		$2 !~ /^(BPF_TIMEVAL|BPF_FIB_LOOKUP_[A-Z]+|BPF_F_LINK)$/ &&
 		$2 ~ /^(BPF|DLT)_/ ||
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ptrace_zos.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ptrace_zos.go
--- a/vendor/golang.org/x/sys/unix/ptrace_zos.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/sys/unix/ptrace_zos.go	2026-10-28 10:20:23.642875849 +0000
@@ -0,0 +1,537 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build zos
+
+package unix
+
+import "unsafe"
+
+// z/OS ptrace implementation notes:
+//
+// This file provides ptrace wrappers for z/OS that match the Linux API as closely
+// as possible. However, there are fundamental differences in how z/OS implements
+// process tracing compared to Linux:
+//
+// 1. SYSTEM CALL INTERFACE:
+//    - z/OS uses BPX4PTR (5 parameters) vs Linux ptrace syscall (4 parameters)
+//    - The 5th parameter (buffer) is used for block operations
+//
+// 2. MEMORY OPERATIONS:
+//    - z/OS: PT_READ_BLOCK/PT_WRITE_BLOCK for efficient block transfers
+//    - Linux: PTRACE_PEEKTEXT/POKETEXT for word-by-word access
+//
+// 3. REGISTER OPERATIONS:
+//    - z/OS: PT_READ_GPR/PT_WRITE_GPR with register number for 64-bit values
+//    - Linux: PTRACE_GETREGSET/SETREGSET with iovec structure
+//
+// 4. SINGLE-STEPPING:
+//    - z/OS: No native single-step; requires temporary breakpoints or PER
+//    - Linux: PTRACE_SINGLESTEP natively supported
+//      a) Read instruction at current PSW
+//      b) Calculate next instruction address (handle branches)
+//      c) Set temporary breakpoint (SVC 144 = 0x0A90) at next address
+//      d) Continue execution until breakpoint hit
+//      e) Restore original instruction and adjust PSW
+//
+// 5. SYSCALL TRACING:
+//    - z/OS: No PTRACE_SYSCALL equivalent; requires breakpoint-based approach
+//    - Linux: PTRACE_SYSCALL stops at syscall entry/exit
+//      a) Identify BPX syscall vector location
+//      b) Set breakpoints at syscall entry points
+//      c) Detect BASR instructions calling into syscall vector
+//      d) Parse arguments from registers before/after syscall
+//
+// 6. LIMITATIONS:
+//    - PtraceSetOptions: No equivalent (returns ENOSYS)
+//    - PtraceGetEventMsg: No equivalent (returns ENOSYS)
+//    - PtraceSingleStep: Requires complex implementation (returns ENOSYS)
+//    - PtraceInterrupt: No equivalent (returns ENOSYS)
+//    - PtracePokeUser: No PT_WRITE_U (returns ENOSYS)
+//
+// For reference implementations of single-stepping and syscall tracing on z/OS,
+
+// ptrace is the basic wrapper for BPX4PTR on z/OS.
+// Note: z/OS ptrace (BPX4PTR) takes 5 parameters vs 4 on Linux/Darwin.
+// The 5th parameter (buffer) is used for operations like PT_READ_BLOCK/PT_WRITE_BLOCK.
+//
+// data is an integer-valued argument (signal number, register index, byte count,
+// or a target-process address). It is not a Go-managed pointer. We must not pass
+// it to Bpx4ptr as unsafe.Pointer(data) because the garbage collector would treat
+// that integer as a pointer and may crash trying to follow it.
+//
+// Instead we inline the parms array that Bpx4ptr would construct, placing &data
+// at parms[3]. BPX4PTR dereferences parms[3] to obtain the data value, so it
+// receives data unchanged while the GC only ever sees a valid stack pointer.
+func ptrace(request int, pid int, addr uintptr, data uintptr) (err error) {
+	req32 := int32(request)
+	pid32 := int32(pid)
+	var rv, rc, rn int32
+	var buffer unsafe.Pointer
+	parms := [8]unsafe.Pointer{
+		unsafe.Pointer(&req32),
+		unsafe.Pointer(&pid32),
+		unsafe.Pointer(&addr),
+		unsafe.Pointer(&data), // &data, not unsafe.Pointer(data)
+		unsafe.Pointer(&buffer),
+		unsafe.Pointer(&rv),
+		unsafe.Pointer(&rc),
+		unsafe.Pointer(&rn),
+	}
+	bpxcall(parms[:], BPX4PTR)
+	if rv != 0 {
+		err = errnoErr2(Errno(rc), uintptr(rn))
+	}
+	return
+}
+
+// ptracePtr is a variant that accepts unsafe.Pointer for the data parameter.
+// addr is a target-process address (a raw integer), not a Go-managed pointer.
+// We must not pass it to Bpx4ptr as unsafe.Pointer(addr); instead we inline the
+// parms array and place &addr at parms[2], exactly as ptrace() does for data.
+func ptracePtr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
+	req32 := int32(request)
+	pid32 := int32(pid)
+	var rv, rc, rn int32
+	var buffer unsafe.Pointer
+	parms := [8]unsafe.Pointer{
+		unsafe.Pointer(&req32),
+		unsafe.Pointer(&pid32),
+		unsafe.Pointer(&addr), // &addr, not unsafe.Pointer(addr)
+		unsafe.Pointer(&data),
+		unsafe.Pointer(&buffer),
+		unsafe.Pointer(&rv),
+		unsafe.Pointer(&rc),
+		unsafe.Pointer(&rn),
+	}
+	bpxcall(parms[:], BPX4PTR)
+	if rv != 0 {
+		err = errnoErr2(Errno(rc), uintptr(rn))
+	}
+	return
+}
+
+// ptracePtrWithBuffer is used for operations that require the buffer parameter.
+// addr is a target-process address; same &addr treatment as ptracePtr.
+func ptracePtrWithBuffer(request int, pid int, addr uintptr, data unsafe.Pointer, buffer unsafe.Pointer) (err error) {
+	req32 := int32(request)
+	pid32 := int32(pid)
+	var rv, rc, rn int32
+	parms := [8]unsafe.Pointer{
+		unsafe.Pointer(&req32),
+		unsafe.Pointer(&pid32),
+		unsafe.Pointer(&addr), // &addr, not unsafe.Pointer(addr)
+		unsafe.Pointer(&data),
+		unsafe.Pointer(&buffer),
+		unsafe.Pointer(&rv),
+		unsafe.Pointer(&rc),
+		unsafe.Pointer(&rn),
+	}
+	bpxcall(parms[:], BPX4PTR)
+	if rv != 0 {
+		err = errnoErr2(Errno(rc), uintptr(rn))
+	}
+	return
+}
+
+// High-level convenience functions matching the Linux/Darwin API
+
+func PtraceAttach(pid int) (err error) {
+	return ptrace(PT_ATTACH, pid, 0, 0)
+}
+
+func PtraceDetach(pid int) (err error) {
+	return ptrace(PT_DETACH, pid, 0, 0)
+}
+
+func PtraceCont(pid int, signal int) (err error) {
+	// PT_CONTINUE can be interrupted by signals (EINTR), retry if needed
+	for {
+		err = ptrace(PT_CONTINUE, pid, 0, uintptr(signal))
+		if err != EINTR {
+			break
+		}
+	}
+	return err
+}
+
+func PtraceKill(pid int) (err error) {
+	return ptrace(PT_KILL, pid, 0, 0)
+}
+
+// ptracePeek implements the peek operations using PT_READ_BLOCK.
+// On z/OS, PT_READ_BLOCK can read arbitrary-length data efficiently.
+// Unlike Linux which reads word-by-word, z/OS can read blocks directly.
+func ptracePeek(req int, pid int, addr uintptr, out []byte) (count int, err error) {
+	if len(out) == 0 {
+		return 0, nil
+	}
+
+	// z/OS PT_READ_BLOCK can read blocks directly without word-by-word alignment
+	// The buffer parameter points to the output buffer
+	buffer := unsafe.Pointer(&out[0])
+	err = ptracePtrWithBuffer(req, pid, addr, unsafe.Pointer(uintptr(len(out))), buffer)
+	if err != nil {
+		return 0, err
+	}
+	return len(out), nil
+}
+
+// PtracePeekText reads from the traced process's text segment.
+func PtracePeekText(pid int, addr uintptr, out []byte) (count int, err error) {
+	return ptracePeek(PT_READ_BLOCK, pid, addr, out)
+}
+
+// PtracePeekData reads from the traced process's data segment.
+func PtracePeekData(pid int, addr uintptr, out []byte) (count int, err error) {
+	return ptracePeek(PT_READ_BLOCK, pid, addr, out)
+}
+
+// PtracePeekUser reads from the traced process's user area.
+// On z/OS, PT_READ_U reads a 32-bit word from the user area at the specified offset.
+// To match Linux behavior, we implement word-by-word reading for arbitrary lengths.
+func PtracePeekUser(pid int, addr uintptr, out []byte) (count int, err error) {
+	if len(out) == 0 {
+		return 0, nil
+	}
+
+	// PT_READ_U reads 32-bit words from user area
+	// We need to read word-by-word to handle arbitrary lengths
+	n := 0
+	for n < len(out) {
+		var data uint32
+		err = ptracePtr(PT_READ_U, pid, addr+uintptr(n), unsafe.Pointer(&data))
+		if err != nil {
+			return n, err
+		}
+
+		// Copy up to 4 bytes to output
+		remaining := len(out) - n
+		if remaining >= 4 {
+			out[n] = byte(data >> 24)
+			out[n+1] = byte(data >> 16)
+			out[n+2] = byte(data >> 8)
+			out[n+3] = byte(data)
+			n += 4
+		} else {
+			// Handle partial word at the end
+			for i := 0; i < remaining; i++ {
+				out[n+i] = byte(data >> (24 - i*8))
+			}
+			n += remaining
+		}
+	}
+	return n, nil
+}
+
+// ptracePoke implements the poke operations using PT_WRITE_BLOCK.
+func ptracePoke(pokeReq int, peekReq int, pid int, addr uintptr, data []byte) (count int, err error) {
+	if len(data) == 0 {
+		return 0, nil
+	}
+
+	// z/OS PT_WRITE_BLOCK can write blocks directly
+	buffer := unsafe.Pointer(&data[0])
+	err = ptracePtrWithBuffer(pokeReq, pid, addr, unsafe.Pointer(uintptr(len(data))), buffer)
+	if err != nil {
+		return 0, err
+	}
+	return len(data), nil
+}
+
+// PtracePokeText writes to the traced process's text segment.
+func PtracePokeText(pid int, addr uintptr, data []byte) (count int, err error) {
+	return ptracePoke(PT_WRITE_BLOCK, PT_READ_BLOCK, pid, addr, data)
+}
+
+// PtracePokeData writes to the traced process's data segment.
+func PtracePokeData(pid int, addr uintptr, data []byte) (count int, err error) {
+	return ptracePoke(PT_WRITE_BLOCK, PT_READ_BLOCK, pid, addr, data)
+}
+
+// PtracePokeUser writes to the traced process's user area.
+// Note: z/OS does not have a direct PT_WRITE_U equivalent.
+// This function returns ENOSYS to indicate it's not supported.
+// DIFFERENCE FROM LINUX: Linux supports PTRACE_POKEUSR, z/OS does not.
+func PtracePokeUser(pid int, addr uintptr, data []byte) (count int, err error) {
+	// z/OS doesn't have PT_WRITE_U
+	return 0, ENOSYS
+}
+
+// PtraceGetRegs retrieves the general purpose registers from the traced process.
+// On z/OS, PT_READ_GPR can read individual registers as 64-bit values when called
+// with a register number, or read all registers when called with a buffer.
+// This function reads each register individually to ensure full 64-bit values.
+// DIFFERENCE FROM LINUX: Linux uses PTRACE_GETREGSET with iovec, z/OS uses PT_READ_GPR.
+func PtraceGetRegs(pid int, regsout *PtraceRegs) (err error) {
+	// Use PT_REGHSET to enable reading high GPRs for AMODE 64 programs
+	rv, rc, rn := Bpx4ptr(int32(PT_REGHSET), int32(pid), nil, nil, nil)
+	_ = rv
+	_ = rc
+	_ = rn
+
+	// Use PT_BLOCKREQ to read GPRs and PSW in one call
+	// dbx uses 3 requests: PT_READ_GPR, PT_READ_U, PT_READ_GPRH
+	// PT_READ_U is required for ptrace to populate PSW in GPR block
+	//
+	// IMPORTANT: z/OS ptrace always returns 64-bit ESA/390 format PSW in the Psw field.
+	// The 128-bit Pswg field is never populated, even with PSWG_Req bit set.
+	// We convert ESA/390 to z/Architecture format in software (matching DBX behavior).
+	const (
+		numRequests = 3
+		reqSize     = int(unsafe.Sizeof(PtraceBlkReqReq{}))
+		gprSize     = int(unsafe.Sizeof(PtraceBlkGpr{}))
+		uareaSize   = int(unsafe.Sizeof(PtraceBlkUar{})) + 6*int(unsafe.Sizeof(PtraceBlkUarOcw{}))
+		totalSize   = int(unsafe.Sizeof(PtraceBlkReq{})) + numRequests*reqSize + gprSize*2 + uareaSize
+	)
+
+	// Allocate buffer for block request
+	buf := make([]byte, totalSize)
+
+	// Setup block request header
+	blkReq := (*PtraceBlkReq)(unsafe.Pointer(&buf[0]))
+	blkReq.Numreq = numRequests
+
+	// Setup request array
+	reqOffset := int(unsafe.Sizeof(PtraceBlkReq{}))
+	reqs := (*[3]PtraceBlkReqReq)(unsafe.Pointer(&buf[reqOffset]))
+
+	// Setup GPR block (lower 32 bits)
+	gprOffset := reqOffset + numRequests*reqSize
+	gprBlock := (*PtraceBlkGpr)(unsafe.Pointer(&buf[gprOffset]))
+
+	// Setup user area block (required for PSW)
+	uareaOffset := gprOffset + gprSize
+	uareaBlock := (*PtraceBlkUar)(unsafe.Pointer(&buf[uareaOffset]))
+	uareaBlock.Num = 6 // Number of control info entries
+
+	// Setup user area offset/control words
+	uareaOcw := (*[6]PtraceBlkUarOcw)(unsafe.Pointer(&buf[uareaOffset+int(unsafe.Sizeof(PtraceBlkUar{}))]))
+	uareaOcw[0].Ofs = 1025 // program interrupt code
+	uareaOcw[1].Ofs = 1026 // abend completion code
+	uareaOcw[2].Ofs = 1027 // abend reason code
+	uareaOcw[3].Ofs = 1028 // signal code
+	uareaOcw[4].Ofs = 1029 // instruction length code
+	uareaOcw[5].Ofs = 1030 // process flags
+
+	// Setup high GPR block (upper 32 bits)
+	gprHighOffset := uareaOffset + uareaSize
+	gprHighBlock := (*PtraceBlkGpr)(unsafe.Pointer(&buf[gprHighOffset]))
+
+	// Configure requests (order matters: GPR, U, GPRH)
+	// reqdata contains OFFSET from buffer start, not absolute address
+	// dbx: brr[0].reqdata=(unsigned long)brg; where brg is the offset
+	reqs[0].Reqtype = PT_READ_GPR
+	reqs[0].Reqdata = uint32(gprOffset)
+	reqs[1].Reqtype = PT_READ_U
+	reqs[1].Reqdata = uint32(uareaOffset)
+	reqs[2].Reqtype = PT_READ_GPRH
+	reqs[2].Reqdata = uint32(gprHighOffset)
+
+	// Execute block request
+	rvBlk, rcBlk, rnBlk := Bpx4ptr(int32(PT_BLOCKREQ), int32(pid),
+		unsafe.Pointer(&buf[0]), unsafe.Pointer(uintptr(totalSize)), nil)
+	if rvBlk == -1 {
+		return errnoErr2(Errno(rcBlk), uintptr(rnBlk))
+	}
+
+	// Extract GPRs (combine low and high 32 bits)
+	for i := 0; i < 16; i++ {
+		low := uint64(gprBlock.Gpr[i])
+		high := uint64(gprHighBlock.Gpr[i]) << 32
+		regsout.Gprs[i] = high | low
+	}
+
+	// Extract PSW from GPR block structure
+	// z/OS ptrace ALWAYS returns 8-byte ESA/390 format PSW at offset 144.
+	// The 16-byte PSWG field at offset 152 is NEVER populated (always zero).
+	// We must convert ESA/390 format to z/Architecture format in software (like DBX does).
+	//
+	// ESA/390 PSW format (8 bytes):
+	//   Word 1 (bytes 0-3): Mask with bit 12 = 1 (ECMODE31BIT)
+	//   Word 2 (bytes 4-7): Address with bit 0 = AMODE bit (1=31-bit, 0=64-bit)
+	//
+	// z/Architecture PSW format (16 bytes):
+	//   Mask (bytes 0-7): Extended mask with bit 12 = 0, bits 31-32 = EA+BA (AMODE)
+	//   Addr (bytes 8-15): Full 64-bit instruction address
+
+	// Read ESA/390 PSW as two 32-bit words
+	pswWord1 := uint32(gprBlock.Psw[0])<<24 | uint32(gprBlock.Psw[1])<<16 |
+		uint32(gprBlock.Psw[2])<<8 | uint32(gprBlock.Psw[3])
+	pswWord2 := uint32(gprBlock.Psw[4])<<24 | uint32(gprBlock.Psw[5])<<16 |
+		uint32(gprBlock.Psw[6])<<8 | uint32(gprBlock.Psw[7])
+
+	// Convert ESA/390 to z/Architecture format (matching DBX psw_ESA390_to_zArchitecture)
+	const ECMODE31BIT = uint64(0x0000000000080000)
+	const AMODE31BIT = uint64(0x0000000080000000)
+	const ADDR_MASK_31 = uint64(0x000000007FFFFFFF)
+
+	// Extract AMODE bit from address word (bit 0 of word 2)
+	amode31 := uint64(pswWord2) & AMODE31BIT
+
+	// Mask off AMODE bit from address
+	addr := uint64(pswWord2) & ADDR_MASK_31
+
+	// Convert mask: clear ECMODE31BIT, shift left 32 bits, add AMODE bit
+	mask := uint64(pswWord1) & ^ECMODE31BIT
+	mask = (mask << 32) | amode31
+
+	regsout.Psw.Mask = mask
+	regsout.Psw.Addr = addr
+
+	// Note: Access registers (Acrs), floating point registers (Fp_regs),
+	// PER info (Per_info), and other fields would require additional
+	// PT_READ_* calls. For now, we focus on GPRs and PSW which are
+	// the most commonly used registers for debugging.
+
+	return nil
+}
+
+// ptraceWritePSW writes only the PSW address register.
+// This is a lower-level function used internally for single-stepping.
+// Based on ztrace's write_psw function.
+func ptraceWritePSW(pid int, pswAddr uint32) error {
+	const PTRACE_REG_PSWA = 41
+	rv, rc, rn := Bpx4ptr(int32(PT_WRITE_GPR), int32(pid),
+		unsafe.Pointer(uintptr(PTRACE_REG_PSWA)),
+		unsafe.Pointer(uintptr(pswAddr)),
+		nil)
+	if rv == -1 {
+		return errnoErr2(Errno(rc), uintptr(rn))
+	}
+	return nil
+}
+
+// PtraceSetRegs sets the general purpose registers in the traced process.
+// Uses PT_BLOCKREQ to write GPRs and PSW in a single call, matching dbx implementation.
+// DIFFERENCE FROM LINUX: Linux uses PTRACE_SETREGSET with iovec, z/OS uses PT_BLOCKREQ.
+// NOTE: The process must be in a stopped state for register writes to succeed.
+func PtraceSetRegs(pid int, regs *PtraceRegs) (err error) {
+	// Use PT_REGHSET to enable writing high GPRs for AMODE 64 programs
+	rv, rc, rn := Bpx4ptr(int32(PT_REGHSET), int32(pid), nil, nil, nil)
+	_ = rv
+	_ = rc
+	_ = rn
+
+	// Use PT_BLOCKREQ to write GPRs and PSW in one call
+	const (
+		numRequests = 2
+		reqSize     = int(unsafe.Sizeof(PtraceBlkReqReq{}))
+		gprSize     = int(unsafe.Sizeof(PtraceBlkGpr{}))
+		totalSize   = int(unsafe.Sizeof(PtraceBlkReq{})) + numRequests*reqSize + gprSize*2
+	)
+
+	// Allocate buffer for block request
+	buf := make([]byte, totalSize)
+
+	// Setup block request header
+	blkReq := (*PtraceBlkReq)(unsafe.Pointer(&buf[0]))
+	blkReq.Numreq = numRequests
+
+	// Setup request array
+	reqOffset := int(unsafe.Sizeof(PtraceBlkReq{}))
+	reqs := (*[2]PtraceBlkReqReq)(unsafe.Pointer(&buf[reqOffset]))
+
+	// Setup GPR block (lower 32 bits)
+	gprOffset := reqOffset + numRequests*reqSize
+	gprBlock := (*PtraceBlkGpr)(unsafe.Pointer(&buf[gprOffset]))
+
+	// Setup high GPR block (upper 32 bits)
+	gprHighOffset := gprOffset + gprSize
+	gprHighBlock := (*PtraceBlkGpr)(unsafe.Pointer(&buf[gprHighOffset]))
+
+	// Mark all GPRs as modified (set all 16 bits)
+	gprBlock.Writebitflags = 0xFFFF
+	gprHighBlock.Writebitflags = 0xFFFF
+
+	// Split 64-bit GPRs into low and high 32 bits
+	for i := 0; i < 16; i++ {
+		gprBlock.Gpr[i] = uint32(regs.Gprs[i] & 0xFFFFFFFF)
+		gprHighBlock.Gpr[i] = uint32(regs.Gprs[i] >> 32)
+	}
+
+	// Pack PSW for 31-bit targets (current z/OS)
+	// Upper 32 bits = mask, lower 32 bits = address
+	gprBlock.Wpsw = 1 // Mark PSW as modified
+	// Write PSW in old format (8 bytes at offset 144)
+	// Word 1 (mask) at bytes 0-3, Word 2 (addr) at bytes 4-7
+	pswMask := uint32(regs.Psw.Mask)
+	pswAddr := uint32(regs.Psw.Addr)
+	gprBlock.Psw[0] = byte(pswMask >> 24)
+	gprBlock.Psw[1] = byte(pswMask >> 16)
+	gprBlock.Psw[2] = byte(pswMask >> 8)
+	gprBlock.Psw[3] = byte(pswMask)
+	gprBlock.Psw[4] = byte(pswAddr >> 24)
+	gprBlock.Psw[5] = byte(pswAddr >> 16)
+	gprBlock.Psw[6] = byte(pswAddr >> 8)
+	gprBlock.Psw[7] = byte(pswAddr)
+
+	// Clear extended PSWG (not used for 31-bit targets)
+	for i := 0; i < 16; i++ {
+		gprBlock.Pswg[i] = 0
+	}
+
+	// Configure requests
+	// reqdata contains OFFSET from buffer start, not absolute address
+	reqs[0].Reqtype = PT_WRITE_GPR
+	reqs[0].Reqdata = uint32(gprOffset)
+	reqs[1].Reqtype = PT_WRITE_GPRH
+	reqs[1].Reqdata = uint32(gprHighOffset)
+
+	// Execute block request
+	rvBlk, rcBlk, rnBlk := Bpx4ptr(int32(PT_BLOCKREQ), int32(pid),
+		unsafe.Pointer(&buf[0]), unsafe.Pointer(uintptr(totalSize)), nil)
+	if rvBlk == -1 {
+		return errnoErr2(Errno(rcBlk), uintptr(rnBlk))
+	}
+
+	return nil
+}
+
+// PtraceSetOptions sets ptrace options.
+// DIFFERENCE FROM LINUX: z/OS doesn't have PTRACE_SETOPTIONS equivalent.
+// Returns ENOSYS to indicate this is not supported on z/OS.
+func PtraceSetOptions(pid int, options int) (err error) {
+	return ENOSYS
+}
+
+// PtraceGetEventMsg retrieves a message about the ptrace event.
+// DIFFERENCE FROM LINUX: z/OS doesn't have PTRACE_GETEVENTMSG equivalent.
+// Returns ENOSYS to indicate this is not supported on z/OS.
+func PtraceGetEventMsg(pid int) (msg uint, err error) {
+	return 0, ENOSYS
+}
+
+// PtraceSyscall continues execution and stops at the next syscall entry/exit.
+// DIFFERENCE FROM LINUX: z/OS doesn't have PTRACE_SYSCALL equivalent.
+// This function falls back to PT_CONTINUE and will NOT stop at syscalls.
+//
+// To trace syscalls on z/OS, applications must:
+// 1. Set breakpoints at BPX syscall entry points (requires knowledge of syscall vector)
+// 2. Detect BASR instructions that call into the BPX syscall vector
+// 3. Use PT_LDINFO to identify loaded modules and their entry points
+func PtraceSyscall(pid int, signal int) (err error) {
+	// z/OS doesn't have a direct PTRACE_SYSCALL equivalent
+	// Use PT_CONTINUE as a fallback (won't stop at syscalls)
+	return ptrace(PT_CONTINUE, pid, 0, uintptr(signal))
+}
+
+// Note: PtraceSingleStep is implemented in ptrace_zos_singlestep.go
+// with full two-breakpoint emulation for branch instructions.
+
+// PtraceInterrupt interrupts the traced process.
+// DIFFERENCE FROM LINUX: z/OS doesn't have PTRACE_INTERRUPT equivalent.
+// Returns ENOSYS to indicate this is not supported on z/OS.
+func PtraceInterrupt(pid int) (err error) {
+	return ENOSYS
+}
+
+// PtraceSeize attaches to a process without stopping it.
+// DIFFERENCE FROM LINUX: z/OS doesn't have PTRACE_SEIZE equivalent.
+// Uses PT_ATTACH as a fallback, which will stop the process.
+func PtraceSeize(pid int) (err error) {
+	// z/OS doesn't have PTRACE_SEIZE, use PT_ATTACH
+	// Note: This WILL stop the process, unlike Linux PTRACE_SEIZE
+	return ptrace(PT_ATTACH, pid, 0, 0)
+}
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ptrace_zos_singlestep.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ptrace_zos_singlestep.go
--- a/vendor/golang.org/x/sys/unix/ptrace_zos_singlestep.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/sys/unix/ptrace_zos_singlestep.go	2026-10-28 10:20:23.642875849 +0000
@@ -0,0 +1,425 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build zos
+
+package unix
+
+import (
+	"sync"
+)
+
+// Single-stepping emulation for z/OS
+//
+// z/OS does not have native single-step support like Linux's PTRACE_SINGLESTEP.
+// Instead, single-stepping must be emulated using temporary breakpoints.
+//
+// This file provides a complete implementation of single-step emulation using
+// temporary breakpoints at both the sequential next instruction and branch target.
+
+const (
+	// NO_BRANCH_DEST indicates the instruction is not a branch or cannot branch
+	NO_BRANCH_DEST = 0xFFFFFFFF
+
+	// SVC_144 is the breakpoint instruction (SVC 144 = 0x0A90)
+	SVC_144 = 0x0A90
+
+	// Maximum number of temporary breakpoints (one for next PC, one for branch dest)
+	MAX_TEMP_BREAKPOINTS = 2
+
+	// S/390 branch instruction opcodes
+	// RR format (Register-Register)
+	opBCR   = 0x07 // Branch on Condition Register
+	opBALR  = 0x05 // Branch and Link Register
+	opBASR  = 0x0D // Branch and Save Register
+	opBASSM = 0x0C // Branch and Save and Set Mode
+	opBSM   = 0x0B // Branch and Set Mode
+	opBCTR  = 0x06 // Branch on Count Register
+
+	// RX format (Register-Index-Storage)
+	opBC  = 0x47 // Branch on Condition
+	opBAL = 0x45 // Branch and Link
+	opBCT = 0x46 // Branch on Count
+	opBAS = 0x4D // Branch and Save
+
+	// RS format (Register-Storage)
+	opBXH  = 0x86 // Branch on Index High
+	opBXLE = 0x87 // Branch on Index Low or Equal
+
+	// Extended branch opcodes
+	opBA7 = 0xA7 // A7x series (BRC, BRAS, BRCT, BRCTG)
+	opBC0 = 0xC0 // C0x series (BRASL, BRCL)
+	opBEC = 0xEC // ECxx series (RIEc format: compare-and-branch)
+)
+
+// tempBreakpoint represents a temporary breakpoint for single-stepping
+type tempBreakpoint struct {
+	address      uint64
+	originalInsn [8]byte // Save up to 8 bytes (full instruction)
+	active       bool
+}
+
+// singleStepState manages temporary breakpoints for a process
+type singleStepState struct {
+	mu          sync.Mutex
+	breakpoints [MAX_TEMP_BREAKPOINTS]tempBreakpoint
+}
+
+var (
+	// Global map of process states (pid -> state)
+	processStates   = make(map[int]*singleStepState)
+	processStatesMu sync.Mutex
+)
+
+// getProcessState returns or creates the single-step state for a process
+func getProcessState(pid int) *singleStepState {
+	processStatesMu.Lock()
+	defer processStatesMu.Unlock()
+
+	state, exists := processStates[pid]
+	if !exists {
+		state = &singleStepState{}
+		processStates[pid] = state
+	}
+	return state
+}
+
+// cleanupProcessState removes the state for a process (call on detach)
+func cleanupProcessState(pid int) {
+	processStatesMu.Lock()
+	defer processStatesMu.Unlock()
+	delete(processStates, pid)
+}
+
+// GetInstructionLength returns the length of an S/390 instruction in bytes.
+func GetInstructionLength(firstByte byte) int {
+	switch (firstByte >> 6) & 0x03 {
+	case 0x00:
+		return 2
+	case 0x01, 0x02:
+		return 4
+	case 0x03:
+		return 6
+	default:
+		return 2
+	}
+}
+
+// GetNextInstructionAddr returns the address of the next sequential instruction.
+func GetNextInstructionAddr(pc uint64, instruction []byte) uint64 {
+	if len(instruction) < 1 {
+		return pc + 2
+	}
+	insnLen := GetInstructionLength(instruction[0])
+	return pc + uint64(insnLen)
+}
+
+// CalculateBranchDest calculates the destination address for branch instructions.
+func CalculateBranchDest(pid int, pc uint64, instruction []byte) uint64 {
+	if len(instruction) < 6 {
+		return NO_BRANCH_DEST
+	}
+
+	inst0_15 := uint16(instruction[0])<<8 | uint16(instruction[1])
+	inst16_31 := uint16(instruction[2])<<8 | uint16(instruction[3])
+	inst32_47 := uint16(instruction[4])<<8 | uint16(instruction[5])
+	opcode := instruction[0]
+
+	var dest uint64 = NO_BRANCH_DEST
+
+	// RR format branches
+	if opcode == opBCR || opcode == opBALR || opcode == opBASR ||
+		opcode == opBASSM || opcode == opBSM || opcode == opBCTR {
+
+		r2 := int(inst0_15 & 0x0F)
+
+		if opcode == opBCR {
+			mask := int((inst0_15 >> 4) & 0x0F)
+			if mask == 0 || r2 == 0 {
+				return NO_BRANCH_DEST
+			}
+		} else {
+			if r2 == 0 {
+				return NO_BRANCH_DEST
+			}
+		}
+
+		var regs PtraceRegs
+		if err := PtraceGetRegs(pid, &regs); err == nil {
+			if r2 >= 0 && r2 < 16 {
+				regVal := regs.Gprs[r2]
+				dest = regVal
+			}
+		}
+	} else if opcode == opBC || opcode == opBAL || opcode == opBCT || opcode == opBAS {
+		// RX format branches
+		if opcode == opBC {
+			mask := int((inst0_15 >> 4) & 0x0F)
+			if mask == 0 {
+				return NO_BRANCH_DEST
+			}
+		}
+
+		index := int(inst0_15 & 0x0F)
+		base := int((inst16_31 >> 12) & 0x0F)
+		displacement := uint32(inst16_31 & 0x0FFF)
+
+		var baseVal, indexVal uint64
+		var regs PtraceRegs
+		if err := PtraceGetRegs(pid, &regs); err == nil {
+			if base != 0 && base < 16 {
+				baseVal = regs.Gprs[base]
+			}
+			if index != 0 && index < 16 {
+				indexVal = regs.Gprs[index]
+			}
+		}
+
+		if base == 0 && index == 0 {
+			dest = pc + uint64(displacement)
+		} else {
+			dest = baseVal + indexVal + uint64(displacement)
+		}
+	} else if opcode == opBXH || opcode == opBXLE {
+		// RS format branches
+		base := int((inst16_31 >> 12) & 0x0F)
+		displacement := uint32(inst16_31 & 0x0FFF)
+
+		var baseVal uint64
+		var regs PtraceRegs
+		if err := PtraceGetRegs(pid, &regs); err == nil {
+			if base != 0 && base < 16 {
+				baseVal = regs.Gprs[base]
+			}
+		}
+
+		dest = baseVal + uint64(displacement)
+	} else if opcode == opBA7 {
+		// RI format branches
+		subOp := int(inst0_15 & 0x0F)
+
+		if subOp < 4 || subOp > 7 {
+			return NO_BRANCH_DEST
+		}
+
+		if subOp == 0x04 {
+			mask := int((inst0_15 >> 4) & 0x0F)
+			if mask == 0 {
+				return NO_BRANCH_DEST
+			}
+		}
+
+		relDispl := int16(inst16_31)
+		dest = uint64(int64(pc) + int64(relDispl)*2)
+	} else if opcode == opBC0 {
+		// RIL format branches
+		subOp := int(inst0_15 & 0x0F)
+
+		if subOp == 0x04 || subOp == 0x05 {
+			if subOp == 0x04 {
+				mask := int((inst0_15 >> 4) & 0x0F)
+				if mask == 0 {
+					return NO_BRANCH_DEST
+				}
+			}
+
+			inst16_47 := (uint32(inst16_31) << 16) | uint32(inst32_47)
+			relDispl4 := int32(inst16_47)
+			dest = uint64(int64(pc) + int64(relDispl4)*2)
+		}
+	} else if opcode == opBEC {
+		// RIEc format compare-and-branch
+		subOp := instruction[4]
+
+		isCompareBranch := (subOp >= 0x64 && subOp <= 0x67) ||
+			(subOp >= 0x76 && subOp <= 0x77) ||
+			(subOp >= 0x7C && subOp <= 0x7F)
+
+		if isCompareBranch {
+			ri4 := int16(inst16_31)
+			dest = uint64(int64(pc) + int64(ri4)*2)
+		}
+	}
+
+	if dest < 0x2000 {
+		return NO_BRANCH_DEST
+	}
+
+	return dest
+}
+
+// setTempBreakpoint sets a temporary breakpoint at the specified address
+func (s *singleStepState) setTempBreakpoint(pid int, addr uint64) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	// Find free slot
+	slot := -1
+	for i := 0; i < MAX_TEMP_BREAKPOINTS; i++ {
+		if !s.breakpoints[i].active {
+			slot = i
+			break
+		}
+	}
+
+	if slot == -1 {
+		return ENOMEM // All slots in use
+	}
+
+	// Read original instruction (up to 8 bytes for safety)
+	_, err := PtracePeekText(pid, uintptr(addr), s.breakpoints[slot].originalInsn[:])
+	if err != nil {
+		return err
+	}
+
+	// Write SVC 144 (0x0A90) as breakpoint
+	svc144 := []byte{0x0A, 0x90}
+	_, err = PtracePokeText(pid, uintptr(addr), svc144)
+	if err != nil {
+		return err
+	}
+
+	s.breakpoints[slot].address = addr
+	s.breakpoints[slot].active = true
+
+	return nil
+}
+
+// removeTempBreakpoints removes all active temporary breakpoints
+func (s *singleStepState) removeTempBreakpoints(pid int) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	var lastErr error
+	for i := 0; i < MAX_TEMP_BREAKPOINTS; i++ {
+		if !s.breakpoints[i].active {
+			continue
+		}
+
+		// Restore original instruction (first 2 bytes are enough for SVC 144)
+		_, err := PtracePokeText(pid, uintptr(s.breakpoints[i].address), s.breakpoints[i].originalInsn[:2])
+		if err != nil {
+			lastErr = err
+		}
+
+		s.breakpoints[i].active = false
+	}
+
+	return lastErr
+}
+
+// isTempBreakpoint checks if an address is a temporary breakpoint
+func (s *singleStepState) isTempBreakpoint(addr uint64) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for i := 0; i < MAX_TEMP_BREAKPOINTS; i++ {
+		if s.breakpoints[i].active && s.breakpoints[i].address == addr {
+			return true
+		}
+	}
+	return false
+}
+
+// PtraceSingleStep executes a single instruction using temporary breakpoints.
+//
+// This function:
+// 1. Reads the current instruction at PSW
+// 2. Calculates the next instruction address (sequential)
+// 3. If branch instruction, calculates branch destination
+// 4. Sets temporary breakpoints at both addresses
+// 5. Continues execution until breakpoint hit
+// 6. Restores original instructions and adjusts PSW
+//
+// Returns nil on success, error on failure.
+func PtraceSingleStep(pid int) error {
+	state := getProcessState(pid)
+
+	// 1. Get current PSW
+	var regs PtraceRegs
+	if err := PtraceGetRegs(pid, &regs); err != nil {
+		return err
+	}
+	pc := regs.Psw.Addr
+
+	// 2. Read instruction at PC
+	insn := make([]byte, 8)
+	if _, err := PtracePeekText(pid, uintptr(pc), insn); err != nil {
+		return err
+	}
+
+	// 3. Calculate next instruction addresses
+	nextPC := GetNextInstructionAddr(pc, insn)
+	branchDest := CalculateBranchDest(pid, pc, insn)
+
+	// 4. Set temporary breakpoints
+	if err := state.setTempBreakpoint(pid, nextPC); err != nil {
+		return err
+	}
+
+	// If branch instruction, set breakpoint at branch destination too
+	if branchDest != NO_BRANCH_DEST && branchDest != nextPC {
+		if err := state.setTempBreakpoint(pid, branchDest); err != nil {
+			state.removeTempBreakpoints(pid) // Cleanup first breakpoint
+			return err
+		}
+	}
+
+	// 5. Continue execution
+	if err := PtraceCont(pid, 0); err != nil {
+		state.removeTempBreakpoints(pid)
+		return err
+	}
+
+	// 6. Wait for breakpoint hit (retry on EINTR)
+	var status WaitStatus
+	for {
+		_, err := Wait4(pid, &status, 0, nil)
+		if err == EINTR {
+			continue // Retry on interrupted system call
+		}
+		if err != nil {
+			state.removeTempBreakpoints(pid)
+			return err
+		}
+		break
+	}
+
+	// Check if process stopped (should be at breakpoint)
+	if !status.Stopped() {
+		state.removeTempBreakpoints(pid)
+		return ECHILD // Process exited or error
+	}
+
+	// 7. Get current PSW (should be at breakpoint + 2)
+	if err := PtraceGetRegs(pid, &regs); err != nil {
+		state.removeTempBreakpoints(pid)
+		return err
+	}
+
+	// 8. Remove temporary breakpoints
+	if err := state.removeTempBreakpoints(pid); err != nil {
+		return err
+	}
+
+	// 9. Back up PSW by 2 bytes (to point at original instruction, not SVC 144)
+	// Use direct PSW write like ztrace does, not full register set
+	hitAddr := regs.Psw.Addr
+	if state.isTempBreakpoint(hitAddr - 2) {
+		if err := ptraceWritePSW(pid, uint32(hitAddr-2)); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// PtraceDetachWithCleanup detaches from a process and cleans up single-step state.
+// Use this instead of PtraceDetach when using PtraceSingleStep.
+func PtraceDetachWithCleanup(pid int) error {
+	state := getProcessState(pid)
+	state.removeTempBreakpoints(pid)
+	cleanupProcessState(pid)
+	return PtraceDetach(pid)
+}
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_darwin.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_darwin.go
--- a/vendor/golang.org/x/sys/unix/syscall_darwin.go	2026-10-28 10:19:50.851179824 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_darwin.go	2026-10-28 10:20:23.642875849 +0000
@@ -369,6 +369,7 @@
  */
 
 //sys	fcntl(fd int, cmd int, arg int) (val int, err error)
+//sys	fcntlPtr(fd int, cmd int, arg unsafe.Pointer) (val int, err error) = SYS_FCNTL
 
 //sys	kill(pid int, signum int, posix int) (err error)
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_freebsd.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_freebsd.go
--- a/vendor/golang.org/x/sys/unix/syscall_freebsd.go	2026-10-28 10:19:50.851179824 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd.go	2026-10-28 10:20:23.642875849 +0000
@@ -369,6 +369,15 @@
 //sys	ExtattrSetLink(link string, attrnamespace int, attrname string, data uintptr, nbytes int) (ret int, err error)
 //sys	ExtattrDeleteLink(link string, attrnamespace int, attrname string) (err error)
 //sys	ExtattrListLink(link string, attrnamespace int, data uintptr, nbytes int) (ret int, err error)
+//sys	extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_POSIX_FADVISE
 //sys	Faccessat(dirfd int, path string, mode uint32, flags int) (err error)
 //sys	Fchdir(fd int) (err error)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_linux.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_linux.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux.go	2026-10-28 10:19:50.851179824 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux.go	2026-10-28 10:20:23.646875810 +0000
@@ -1991,7 +1991,24 @@
 	return fsconfig(fd, FSCONFIG_CMD_RECONFIGURE, nil, nil, 0)
 }
 
-//sys	Getdents(fd int, buf []byte) (n int, err error) = SYS_GETDENTS64
+//sys	getdents(fd int, buf []byte) (n int, err error) = SYS_GETDENTS64
+
+// Getdents reads directory entries from fd into buf.
+func Getdents(fd int, buf []byte) (n int, err error) {
+	// getdents64 stores d_ino with a 64-bit write, which faults on
+	// strict-alignment targets unless buf is 8-aligned.
+	if len(buf) > 0 {
+		if off := int(-uintptr(unsafe.Pointer(&buf[0])) & 7); off > 0 && off < len(buf) {
+			n, err = getdents(fd, buf[off:])
+			if n > 0 {
+				copy(buf, buf[off:off+n])
+			}
+			return n, err
+		}
+	}
+	return getdents(fd, buf)
+}
+
 //sysnb	Getpgid(pid int) (pgid int, err error)
 
 func Getpgrp() (pid int) {
@@ -2033,6 +2050,7 @@
 //sysnb	Kill(pid int, sig syscall.Signal) (err error)
 //sys	Klogctl(typ int, buf []byte) (n int, err error) = SYS_SYSLOG
 //sys	Lgetxattr(path string, attr string, dest []byte) (sz int, err error)
+//sys	Listns(req *NsIdReq, nsIds []uint64, flags uint) (n int, err error)
 //sys	Listxattr(path string, dest []byte) (sz int, err error)
 //sys	Llistxattr(path string, dest []byte) (sz int, err error)
 //sys	Lremovexattr(path string, attr string) (err error)
@@ -2046,6 +2064,7 @@
 //sys	PerfEventOpen(attr *PerfEventAttr, pid int, cpu int, groupFd int, flags int) (fd int, err error)
 //sys	PivotRoot(newroot string, putold string) (err error) = SYS_PIVOT_ROOT
 //sys	Prctl(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 uintptr) (err error)
+//sys	PrctlArg5Ptr(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 unsafe.Pointer) (err error) = SYS_PRCTL
 //sys	pselect6(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *sigset_argpack) (n int, err error)
 //sys	read(fd int, p []byte) (n int, err error)
 //sys	Removexattr(path string, attr string) (err error)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go	2026-10-28 10:19:50.851179824 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go	2026-10-28 10:20:23.646875810 +0000
@@ -8,7 +8,7 @@
 
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
-//sys	Fstat(fd int, stat *Stat_t) (err error)
+//sys	Fstat(fd int, stat *Stat_t) (err error) = SYS_FSTAT64
 //sys	Fstatat(dirfd int, path string, stat *Stat_t, flags int) (err error) = SYS_FSTATAT64
 //sys	Fstatfs(fd int, buf *Statfs_t) (err error)
 //sys	Ftruncate(fd int, length int64) (err error)
@@ -19,7 +19,7 @@
 //sysnb	Getuid() (uid int)
 //sys	Lchown(path string, uid int, gid int) (err error)
 //sys	Listen(s int, n int) (err error)
-//sys	Lstat(path string, stat *Stat_t) (err error)
+//sys	Lstat(path string, stat *Stat_t) (err error) = SYS_LSTAT64
 //sys	Pause() (err error)
 //sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
 //sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
@@ -31,7 +31,7 @@
 //sys	setfsuid(uid int) (prev int, err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
-//sys	Stat(path string, stat *Stat_t) (err error)
+//sys	Stat(path string, stat *Stat_t) (err error) = SYS_STAT64
 //sys	Statfs(path string, buf *Statfs_t) (err error)
 //sys	SyncFileRange(fd int, off int64, n int64, flags int) (err error)
 //sys	Truncate(path string, length int64) (err error)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_netbsd.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_netbsd.go
--- a/vendor/golang.org/x/sys/unix/syscall_netbsd.go	2026-10-28 10:19:50.851179824 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_netbsd.go	2026-10-28 10:20:23.646875810 +0000
@@ -293,6 +293,15 @@
 //sys	ExtattrSetLink(link string, attrnamespace int, attrname string, data uintptr, nbytes int) (ret int, err error)
 //sys	ExtattrDeleteLink(link string, attrnamespace int, attrname string) (err error)
 //sys	ExtattrListLink(link string, attrnamespace int, data uintptr, nbytes int) (ret int, err error)
+//sys	extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
 //sys	Faccessat(dirfd int, path string, mode uint32, flags int) (err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_POSIX_FADVISE
 //sys	Fchdir(fd int) (err error)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_unix_gc.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_unix_gc.go
--- a/vendor/golang.org/x/sys/unix/syscall_unix_gc.go	2026-10-28 10:19:50.855179785 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_unix_gc.go	2026-10-28 10:20:23.646875810 +0000
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (darwin || dragonfly || freebsd || (linux && !ppc64 && !ppc64le) || netbsd || openbsd || solaris) && gc
+//go:build (darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris) && gc
 
 package unix
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_unix_gc_ppc64x.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_unix_gc_ppc64x.go
--- a/vendor/golang.org/x/sys/unix/syscall_unix_gc_ppc64x.go	2026-10-28 10:19:50.855179785 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_unix_gc_ppc64x.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,22 +0,0 @@
-// Copyright 2018 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build linux && (ppc64le || ppc64) && gc
-
-package unix
-
-import "syscall"
-
-func Syscall(trap, a1, a2, a3 uintptr) (r1, r2 uintptr, err syscall.Errno) {
-	return syscall.Syscall(trap, a1, a2, a3)
-}
-func Syscall6(trap, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err syscall.Errno) {
-	return syscall.Syscall6(trap, a1, a2, a3, a4, a5, a6)
-}
-func RawSyscall(trap, a1, a2, a3 uintptr) (r1, r2 uintptr, err syscall.Errno) {
-	return syscall.RawSyscall(trap, a1, a2, a3)
-}
-func RawSyscall6(trap, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err syscall.Errno) {
-	return syscall.RawSyscall6(trap, a1, a2, a3, a4, a5, a6)
-}
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
--- a/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go	2026-10-28 10:19:50.855179785 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go	2026-10-28 10:20:23.646875810 +0000
@@ -28,13 +28,9 @@
 )
 
 //go:noescape
-func initZosLibVec()
-
-//go:noescape
 func GetZosLibVec() uintptr
 
 func init() {
-	initZosLibVec()
 	r0, _, _ := CallLeFuncWithPtrReturn(GetZosLibVec()+SYS_____GETENV_A<<4, uintptr(unsafe.Pointer(&([]byte("__ZOS_XSYSTRACE\x00"))[0])))
 	if r0 != 0 {
 		n, _, _ := CallLeFuncWithPtrReturn(GetZosLibVec()+SYS___ATOI_A<<4, r0)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/xattr_bsd.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/xattr_bsd.go
--- a/vendor/golang.org/x/sys/unix/xattr_bsd.go	2026-10-28 10:19:50.855179785 +0000
+++ b/vendor/golang.org/x/sys/unix/xattr_bsd.go	2026-10-28 10:20:23.646875810 +0000
@@ -56,7 +56,7 @@
 		return -1, err
 	}
 
-	return ExtattrGetFile(file, nsid, a, uintptr(d), destsize)
+	return extattrGetFile(file, nsid, a, d, destsize)
 }
 
 func Fgetxattr(fd int, attr string, dest []byte) (sz int, err error) {
@@ -68,7 +68,7 @@
 		return -1, err
 	}
 
-	return ExtattrGetFd(fd, nsid, a, uintptr(d), destsize)
+	return extattrGetFd(fd, nsid, a, d, destsize)
 }
 
 func Lgetxattr(link string, attr string, dest []byte) (sz int, err error) {
@@ -80,7 +80,7 @@
 		return -1, err
 	}
 
-	return ExtattrGetLink(link, nsid, a, uintptr(d), destsize)
+	return extattrGetLink(link, nsid, a, d, destsize)
 }
 
 // flags are unused on FreeBSD
@@ -97,7 +97,7 @@
 		return
 	}
 
-	_, err = ExtattrSetFd(fd, nsid, a, uintptr(d), datasiz)
+	_, err = extattrSetFd(fd, nsid, a, d, datasiz)
 	return
 }
 
@@ -113,7 +113,7 @@
 		return
 	}
 
-	_, err = ExtattrSetFile(file, nsid, a, uintptr(d), datasiz)
+	_, err = extattrSetFile(file, nsid, a, d, datasiz)
 	return
 }
 
@@ -129,7 +129,7 @@
 		return
 	}
 
-	_, err = ExtattrSetLink(link, nsid, a, uintptr(d), datasiz)
+	_, err = extattrSetLink(link, nsid, a, d, datasiz)
 	return
 }
 
@@ -199,9 +199,9 @@
 	d := initxattrdest(dest, 0)
 	destsiz := len(dest)
 
-	s, e := ExtattrListFile(file, nsid, uintptr(d), destsiz)
+	s, e := extattrListFile(file, nsid, d, destsiz)
 	if e != nil {
-		return 0, err
+		return 0, e
 	}
 
 	return s, nil
@@ -235,9 +235,9 @@
 	d := initxattrdest(dest, 0)
 	destsiz := len(dest)
 
-	s, e := ExtattrListFd(fd, nsid, uintptr(d), destsiz)
+	s, e := extattrListFd(fd, nsid, d, destsiz)
 	if e != nil {
-		return 0, err
+		return 0, e
 	}
 
 	return s, nil
@@ -271,9 +271,9 @@
 	d := initxattrdest(dest, 0)
 	destsiz := len(dest)
 
-	s, e := ExtattrListLink(link, nsid, uintptr(d), destsiz)
+	s, e := extattrListLink(link, nsid, d, destsiz)
 	if e != nil {
-		return 0, err
+		return 0, e
 	}
 
 	return s, nil
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go	2026-10-28 10:19:50.855179785 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go	2026-10-28 10:20:23.646875810 +0000
@@ -1128,6 +1128,7 @@
 	O_DSYNC                                 = 0x400000
 	O_EVTONLY                               = 0x8000
 	O_EXCL                                  = 0x800
+	O_EXEC                                  = 0x40000000
 	O_EXLOCK                                = 0x20
 	O_FSYNC                                 = 0x80
 	O_NDELAY                                = 0x4
@@ -1138,6 +1139,7 @@
 	O_POPUP                                 = 0x80000000
 	O_RDONLY                                = 0x0
 	O_RDWR                                  = 0x2
+	O_SEARCH                                = 0x40100000
 	O_SHLOCK                                = 0x10
 	O_SYMLINK                               = 0x200000
 	O_SYNC                                  = 0x80
@@ -1147,6 +1149,10 @@
 	PARMRK                                  = 0x8
 	PARODD                                  = 0x2000
 	PENDIN                                  = 0x20000000
+	PRIO_DARWIN_BG                          = 0x1000
+	PRIO_DARWIN_NONUI                       = 0x1001
+	PRIO_DARWIN_PROCESS                     = 0x4
+	PRIO_DARWIN_THREAD                      = 0x3
 	PRIO_PGRP                               = 0x1
 	PRIO_PROCESS                            = 0x0
 	PRIO_USER                               = 0x2
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go	2026-10-28 10:19:50.855179785 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go	2026-10-28 10:20:23.646875810 +0000
@@ -1128,6 +1128,7 @@
 	O_DSYNC                                 = 0x400000
 	O_EVTONLY                               = 0x8000
 	O_EXCL                                  = 0x800
+	O_EXEC                                  = 0x40000000
 	O_EXLOCK                                = 0x20
 	O_FSYNC                                 = 0x80
 	O_NDELAY                                = 0x4
@@ -1138,6 +1139,7 @@
 	O_POPUP                                 = 0x80000000
 	O_RDONLY                                = 0x0
 	O_RDWR                                  = 0x2
+	O_SEARCH                                = 0x40100000
 	O_SHLOCK                                = 0x10
 	O_SYMLINK                               = 0x200000
 	O_SYNC                                  = 0x80
@@ -1147,6 +1149,10 @@
 	PARMRK                                  = 0x8
 	PARODD                                  = 0x2000
 	PENDIN                                  = 0x20000000
+	PRIO_DARWIN_BG                          = 0x1000
+	PRIO_DARWIN_NONUI                       = 0x1001
+	PRIO_DARWIN_PROCESS                     = 0x4
+	PRIO_DARWIN_THREAD                      = 0x3
 	PRIO_PGRP                               = 0x1
 	PRIO_PROCESS                            = 0x0
 	PRIO_USER                               = 0x2
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux.go	2026-10-28 10:20:23.650875772 +0000
@@ -752,10 +752,12 @@
 	CLONE_ARGS_SIZE_VER0                        = 0x40
 	CLONE_ARGS_SIZE_VER1                        = 0x50
 	CLONE_ARGS_SIZE_VER2                        = 0x58
+	CLONE_AUTOREAP                              = 0x400000000
 	CLONE_CHILD_CLEARTID                        = 0x200000
 	CLONE_CHILD_SETTID                          = 0x1000000
 	CLONE_CLEAR_SIGHAND                         = 0x100000000
 	CLONE_DETACHED                              = 0x400000
+	CLONE_EMPTY_MNTNS                           = 0x2000000000
 	CLONE_FILES                                 = 0x400
 	CLONE_FS                                    = 0x200
 	CLONE_INTO_CGROUP                           = 0x200000000
@@ -768,9 +770,11 @@
 	CLONE_NEWTIME                               = 0x80
 	CLONE_NEWUSER                               = 0x10000000
 	CLONE_NEWUTS                                = 0x4000000
+	CLONE_NNP                                   = 0x800000000
 	CLONE_PARENT                                = 0x8000
 	CLONE_PARENT_SETTID                         = 0x100000
 	CLONE_PIDFD                                 = 0x1000
+	CLONE_PIDFD_AUTOKILL                        = 0x1000000000
 	CLONE_PTRACE                                = 0x2000
 	CLONE_SETTLS                                = 0x80000
 	CLONE_SIGHAND                               = 0x800
@@ -803,12 +807,15 @@
 	DEVLINK_GENL_MCGRP_CONFIG_NAME              = "config"
 	DEVLINK_GENL_NAME                           = "devlink"
 	DEVLINK_GENL_VERSION                        = 0x1
+	DEVLINK_INDEX_BUS_NAME                      = "devlink_index"
 	DEVLINK_PORT_FN_CAP_IPSEC_CRYPTO            = 0x4
 	DEVLINK_PORT_FN_CAP_IPSEC_PACKET            = 0x8
 	DEVLINK_PORT_FN_CAP_MIGRATABLE              = 0x2
 	DEVLINK_PORT_FN_CAP_ROCE                    = 0x1
 	DEVLINK_RATE_TCS_MAX                        = 0x8
 	DEVLINK_RATE_TC_INDEX_MAX                   = 0x7
+	DEVLINK_RESOURCE_SCOPE_DEV                  = 0x1
+	DEVLINK_RESOURCE_SCOPE_PORT                 = 0x2
 	DEVLINK_SB_THRESHOLD_TO_ALPHA_MAX           = 0x14
 	DEVLINK_SUPPORTED_FLASH_OVERWRITE_SECTIONS  = 0x3
 	DEVMEM_MAGIC                                = 0x454d444d
@@ -1127,6 +1134,7 @@
 	ETHTOOL_SWOL                                = 0x6
 	ETHTOOL_TEST                                = 0x1a
 	ETH_P_1588                                  = 0x88f7
+	ETH_P_8021AC                                = 0x8870
 	ETH_P_8021AD                                = 0x88a8
 	ETH_P_8021AH                                = 0x88e7
 	ETH_P_8021Q                                 = 0x8100
@@ -1170,6 +1178,7 @@
 	ETH_P_ETHERCAT                              = 0x88a4
 	ETH_P_FCOE                                  = 0x8906
 	ETH_P_FIP                                   = 0x8914
+	ETH_P_GRE_OSI                               = 0xfe
 	ETH_P_HDLC                                  = 0x19
 	ETH_P_HSR                                   = 0x892f
 	ETH_P_IBOE                                  = 0x8915
@@ -1198,6 +1207,7 @@
 	ETH_P_MXLGSW                                = 0x88c3
 	ETH_P_NCSI                                  = 0x88f8
 	ETH_P_NSH                                   = 0x894f
+	ETH_P_NXP_NETC                              = 0xfd3a
 	ETH_P_PAE                                   = 0x888e
 	ETH_P_PAUSE                                 = 0x8808
 	ETH_P_PHONET                                = 0xf5
@@ -1359,6 +1369,7 @@
 	FAN_UNLIMITED_MARKS                         = 0x20
 	FAN_UNLIMITED_QUEUE                         = 0x10
 	FD_CLOEXEC                                  = 0x1
+	FD_NSFS_ROOT                                = -0x2713
 	FD_PIDFS_ROOT                               = -0x2712
 	FD_SETSIZE                                  = 0x400
 	FF0                                         = 0x0
@@ -1427,6 +1438,8 @@
 	FS_POLICY_FLAGS_PAD_8                       = 0x1
 	FS_POLICY_FLAGS_PAD_MASK                    = 0x3
 	FS_POLICY_FLAGS_VALID                       = 0x7
+	FS_SHUTDOWN_FLAGS_LOGFLUSH                  = 0x1
+	FS_SHUTDOWN_FLAGS_NOLOGFLUSH                = 0x2
 	FS_VERITY_FL                                = 0x100000
 	FS_VERITY_HASH_ALG_SHA256                   = 0x1
 	FS_VERITY_HASH_ALG_SHA512                   = 0x2
@@ -1441,6 +1454,7 @@
 	F_DUPFD_CLOEXEC                             = 0x406
 	F_DUPFD_QUERY                               = 0x403
 	F_EXLCK                                     = 0x4
+	F_GETDELEG                                  = 0x40f
 	F_GETFD                                     = 0x1
 	F_GETFL                                     = 0x3
 	F_GETLEASE                                  = 0x401
@@ -1462,6 +1476,7 @@
 	F_SEAL_SEAL                                 = 0x1
 	F_SEAL_SHRINK                               = 0x2
 	F_SEAL_WRITE                                = 0x8
+	F_SETDELEG                                  = 0x410
 	F_SETFD                                     = 0x2
 	F_SETFL                                     = 0x4
 	F_SETLEASE                                  = 0x400
@@ -1632,6 +1647,7 @@
 	IN_UNMOUNT                                  = 0x2000
 	IOCTL_MEI_CONNECT_CLIENT                    = 0xc0104801
 	IOCTL_MEI_CONNECT_CLIENT_VTAG               = 0xc0144804
+	IPPROTO_AGGFRAG                             = 0x90
 	IPPROTO_AH                                  = 0x33
 	IPPROTO_BEETPH                              = 0x5e
 	IPPROTO_COMP                                = 0x6c
@@ -1913,10 +1929,14 @@
 	LANDLOCK_ACCESS_FS_REFER                    = 0x2000
 	LANDLOCK_ACCESS_FS_REMOVE_DIR               = 0x10
 	LANDLOCK_ACCESS_FS_REMOVE_FILE              = 0x20
+	LANDLOCK_ACCESS_FS_RESOLVE_UNIX             = 0x10000
 	LANDLOCK_ACCESS_FS_TRUNCATE                 = 0x4000
 	LANDLOCK_ACCESS_FS_WRITE_FILE               = 0x2
 	LANDLOCK_ACCESS_NET_BIND_TCP                = 0x1
+	LANDLOCK_ACCESS_NET_BIND_UDP                = 0x4
+	LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP        = 0x8
 	LANDLOCK_ACCESS_NET_CONNECT_TCP             = 0x2
+	LANDLOCK_ADD_RULE_QUIET                     = 0x1
 	LANDLOCK_CREATE_RULESET_ERRATA              = 0x2
 	LANDLOCK_CREATE_RULESET_VERSION             = 0x1
 	LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON      = 0x2
@@ -3408,6 +3428,7 @@
 	SCHED_FLAG_UTIL_CLAMP                       = 0x60
 	SCHED_FLAG_UTIL_CLAMP_MAX                   = 0x40
 	SCHED_FLAG_UTIL_CLAMP_MIN                   = 0x20
+	SCHED_GETATTR_FLAG_DL_DYNAMIC               = 0x1
 	SCHED_IDLE                                  = 0x5
 	SCHED_NORMAL                                = 0x0
 	SCHED_RESET_ON_FORK                         = 0x40000000
@@ -3790,6 +3811,14 @@
 	TCPOPT_TIMESTAMP                            = 0x8
 	TCPOPT_TSTAMP_HDR                           = 0x101080a
 	TCPOPT_WINDOW                               = 0x3
+	TCP_ACCECN_ACE_FAIL_RECV                    = 0x2
+	TCP_ACCECN_ACE_FAIL_SEND                    = 0x1
+	TCP_ACCECN_OPT_COUNTER_SEEN                 = 0x2
+	TCP_ACCECN_OPT_EMPTY_SEEN                   = 0x1
+	TCP_ACCECN_OPT_FAIL_RECV                    = 0x8
+	TCP_ACCECN_OPT_FAIL_SEEN                    = 0x3
+	TCP_ACCECN_OPT_FAIL_SEND                    = 0x4
+	TCP_ACCECN_OPT_NOT_SEEN                     = 0x0
 	TCP_AO_KEYF_EXCLUDE_OPT                     = 0x2
 	TCP_AO_KEYF_IFINDEX                         = 0x1
 	TCP_AO_MAXKEYLEN                            = 0x50
@@ -3804,6 +3833,7 @@
 	TCP_COOKIE_TRANSACTIONS                     = 0xf
 	TCP_CORK                                    = 0x3
 	TCP_DEFER_ACCEPT                            = 0x9
+	TCP_DELACK_MAX_US                           = 0x2e
 	TCP_FASTOPEN                                = 0x17
 	TCP_FASTOPEN_CONNECT                        = 0x1e
 	TCP_FASTOPEN_KEY                            = 0x21
@@ -3836,6 +3866,8 @@
 	TCP_REPAIR_OPTIONS                          = 0x16
 	TCP_REPAIR_QUEUE                            = 0x14
 	TCP_REPAIR_WINDOW                           = 0x1d
+	TCP_RTO_MAX_MS                              = 0x2c
+	TCP_RTO_MIN_US                              = 0x2d
 	TCP_SAVED_SYN                               = 0x1c
 	TCP_SAVE_SYN                                = 0x1b
 	TCP_SYNCNT                                  = 0x7
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_386.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_386.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_386.go	2026-10-28 10:20:23.650875772 +0000
@@ -600,6 +600,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -840,6 +841,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go	2026-10-28 10:20:23.650875772 +0000
@@ -600,6 +600,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -840,6 +841,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go	2026-10-28 10:20:23.650875772 +0000
@@ -605,6 +605,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -845,6 +846,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go	2026-10-28 10:20:23.650875772 +0000
@@ -602,6 +602,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -842,6 +843,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go	2026-10-28 10:20:23.650875772 +0000
@@ -592,6 +592,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -832,6 +833,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go	2026-10-28 10:20:23.650875772 +0000
@@ -601,6 +601,7 @@
 	EDQUOT          = syscall.Errno(0x46d)
 	EFSBADCRC       = syscall.Errno(0x4d)
 	EFSCORRUPTED    = syscall.Errno(0x87)
+	EFTYPE          = syscall.Errno(0xa9)
 	EHOSTDOWN       = syscall.Errno(0x93)
 	EHOSTUNREACH    = syscall.Errno(0x94)
 	EHWPOISON       = syscall.Errno(0xa8)
@@ -845,6 +846,7 @@
 	{166, "ENOTRECOVERABLE", "state not recoverable"},
 	{167, "ERFKILL", "operation not possible due to RF-kill"},
 	{168, "EHWPOISON", "memory page has hardware error"},
+	{169, "EFTYPE", "unknown error 169"},
 	{1133, "EDQUOT", "disk quota exceeded"},
 }
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go	2026-10-28 10:20:23.650875772 +0000
@@ -601,6 +601,7 @@
 	EDQUOT          = syscall.Errno(0x46d)
 	EFSBADCRC       = syscall.Errno(0x4d)
 	EFSCORRUPTED    = syscall.Errno(0x87)
+	EFTYPE          = syscall.Errno(0xa9)
 	EHOSTDOWN       = syscall.Errno(0x93)
 	EHOSTUNREACH    = syscall.Errno(0x94)
 	EHWPOISON       = syscall.Errno(0xa8)
@@ -845,6 +846,7 @@
 	{166, "ENOTRECOVERABLE", "state not recoverable"},
 	{167, "ERFKILL", "operation not possible due to RF-kill"},
 	{168, "EHWPOISON", "memory page has hardware error"},
+	{169, "EFTYPE", "unknown error 169"},
 	{1133, "EDQUOT", "disk quota exceeded"},
 }
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go	2026-10-28 10:20:23.650875772 +0000
@@ -601,6 +601,7 @@
 	EDQUOT          = syscall.Errno(0x46d)
 	EFSBADCRC       = syscall.Errno(0x4d)
 	EFSCORRUPTED    = syscall.Errno(0x87)
+	EFTYPE          = syscall.Errno(0xa9)
 	EHOSTDOWN       = syscall.Errno(0x93)
 	EHOSTUNREACH    = syscall.Errno(0x94)
 	EHWPOISON       = syscall.Errno(0xa8)
@@ -845,6 +846,7 @@
 	{166, "ENOTRECOVERABLE", "state not recoverable"},
 	{167, "ERFKILL", "operation not possible due to RF-kill"},
 	{168, "EHWPOISON", "memory page has hardware error"},
+	{169, "EFTYPE", "unknown error 169"},
 	{1133, "EDQUOT", "disk quota exceeded"},
 }
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go	2026-10-28 10:20:23.650875772 +0000
@@ -601,6 +601,7 @@
 	EDQUOT          = syscall.Errno(0x46d)
 	EFSBADCRC       = syscall.Errno(0x4d)
 	EFSCORRUPTED    = syscall.Errno(0x87)
+	EFTYPE          = syscall.Errno(0xa9)
 	EHOSTDOWN       = syscall.Errno(0x93)
 	EHOSTUNREACH    = syscall.Errno(0x94)
 	EHWPOISON       = syscall.Errno(0xa8)
@@ -845,6 +846,7 @@
 	{166, "ENOTRECOVERABLE", "state not recoverable"},
 	{167, "ERFKILL", "operation not possible due to RF-kill"},
 	{168, "EHWPOISON", "memory page has hardware error"},
+	{169, "EFTYPE", "unknown error 169"},
 	{1133, "EDQUOT", "disk quota exceeded"},
 }
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go	2026-10-28 10:20:23.650875772 +0000
@@ -657,6 +657,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -898,6 +899,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go	2026-10-28 10:20:23.650875772 +0000
@@ -661,6 +661,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -902,6 +903,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go	2026-10-28 10:20:23.650875772 +0000
@@ -661,6 +661,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -902,6 +903,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go	2026-10-28 10:19:50.859179745 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go	2026-10-28 10:20:23.650875772 +0000
@@ -602,6 +602,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -842,6 +843,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go	2026-10-28 10:19:50.863179706 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go	2026-10-28 10:20:23.650875772 +0000
@@ -661,6 +661,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -901,6 +902,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go	2026-10-28 10:19:50.863179706 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go	2026-10-28 10:20:23.650875772 +0000
@@ -704,6 +704,7 @@
 	EDQUOT          = syscall.Errno(0x45)
 	EFSBADCRC       = syscall.Errno(0x4c)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x88)
 	EHOSTDOWN       = syscall.Errno(0x40)
 	EHOSTUNREACH    = syscall.Errno(0x41)
 	EHWPOISON       = syscall.Errno(0x87)
@@ -950,6 +951,7 @@
 	{133, "ENOTRECOVERABLE", "state not recoverable"},
 	{134, "ERFKILL", "operation not possible due to RF-kill"},
 	{135, "EHWPOISON", "memory page has hardware error"},
+	{136, "EFTYPE", "unknown error 136"},
 }
 
 // Signal table
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go	2026-10-28 10:19:50.863179706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go	2026-10-28 10:20:23.654875733 +0000
@@ -702,6 +702,17 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func fcntlPtr(fd int, cmd int, arg unsafe.Pointer) (val int, err error) {
+	r0, _, e1 := syscall_syscall(libc_fcntl_trampoline_addr, uintptr(fd), uintptr(cmd), uintptr(arg))
+	val = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func kill(pid int, signum int, posix int) (err error) {
 	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), uintptr(posix))
 	if e1 != 0 {
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go	2026-10-28 10:19:50.863179706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go	2026-10-28 10:20:23.654875733 +0000
@@ -702,6 +702,17 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func fcntlPtr(fd int, cmd int, arg unsafe.Pointer) (val int, err error) {
+	r0, _, e1 := syscall_syscall(libc_fcntl_trampoline_addr, uintptr(fd), uintptr(cmd), uintptr(arg))
+	val = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func kill(pid int, signum int, posix int) (err error) {
 	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), uintptr(posix))
 	if e1 != 0 {
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go	2026-10-28 10:19:50.863179706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go	2026-10-28 10:20:23.654875733 +0000
@@ -825,6 +825,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_POSIX_FADVISE, uintptr(fd), uintptr(offset), uintptr(offset>>32), uintptr(length), uintptr(length>>32), uintptr(advice))
 	if e1 != 0 {
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go	2026-10-28 10:19:50.863179706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go	2026-10-28 10:20:23.654875733 +0000
@@ -825,6 +825,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_POSIX_FADVISE, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go	2026-10-28 10:19:50.863179706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go	2026-10-28 10:20:23.654875733 +0000
@@ -825,6 +825,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall9(SYS_POSIX_FADVISE, uintptr(fd), 0, uintptr(offset), uintptr(offset>>32), uintptr(length), uintptr(length>>32), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go	2026-10-28 10:19:50.863179706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go	2026-10-28 10:20:23.654875733 +0000
@@ -825,6 +825,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_POSIX_FADVISE, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go	2026-10-28 10:19:50.863179706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go	2026-10-28 10:20:23.654875733 +0000
@@ -825,6 +825,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_POSIX_FADVISE, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_linux.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_linux.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux.go	2026-10-28 10:19:50.863179706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux.go	2026-10-28 10:20:23.654875733 +0000
@@ -943,7 +943,7 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Getdents(fd int, buf []byte) (n int, err error) {
+func getdents(fd int, buf []byte) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(buf) > 0 {
 		_p0 = unsafe.Pointer(&buf[0])
@@ -1167,6 +1167,23 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func Listns(req *NsIdReq, nsIds []uint64, flags uint) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(nsIds) > 0 {
+		_p0 = unsafe.Pointer(&nsIds[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_LISTNS, uintptr(unsafe.Pointer(req)), uintptr(_p0), uintptr(len(nsIds)), uintptr(flags), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Listxattr(path string, dest []byte) (sz int, err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -1384,6 +1401,16 @@
 	_, _, e1 := Syscall6(SYS_PRCTL, uintptr(option), uintptr(arg2), uintptr(arg3), uintptr(arg4), uintptr(arg5), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func PrctlArg5Ptr(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall6(SYS_PRCTL, uintptr(option), uintptr(arg2), uintptr(arg3), uintptr(arg4), uintptr(arg5), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go	2026-10-28 10:19:50.867179667 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go	2026-10-28 10:20:23.654875733 +0000
@@ -66,7 +66,7 @@
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstat(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := Syscall(SYS_FSTAT64, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -183,7 +183,7 @@
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := Syscall(SYS_LSTAT64, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -338,7 +338,7 @@
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := Syscall(SYS_STAT64, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go	2026-10-28 10:19:50.867179667 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go	2026-10-28 10:20:23.654875733 +0000
@@ -802,6 +802,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go	2026-10-28 10:19:50.867179667 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go	2026-10-28 10:20:23.654875733 +0000
@@ -802,6 +802,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go	2026-10-28 10:19:50.867179667 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go	2026-10-28 10:20:23.654875733 +0000
@@ -802,6 +802,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go	2026-10-28 10:19:50.867179667 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go	2026-10-28 10:20:23.654875733 +0000
@@ -802,6 +802,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.go
--- a/vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.go	2026-10-28 10:20:23.658875695 +0000
@@ -2848,5 +2848,18 @@
 	SYS_____CHATTRAT64_A                = 0xE39 // 3641
 	SYS_MADVISE                         = 0xE3A // 3642
 	SYS___AUTHENTICATE                  = 0xE3B // 3643
+	SYS_GETPWENT_R                      = 0xE3C // 3644
+	SYS___GETPWENT_R_A                  = 0xE3D // 3645
+	SYS_STRNLEN                         = 0xE3E // 3646
+	SYS_STPCPY                          = 0xE3F // 3647
+	SYS_STPNCPY                         = 0xE40 // 3648
+	SYS_STRSIGNAL                       = 0xE41 // 3649
+	SYS_WCPCPY                          = 0xE42 // 3650
+	SYS_WCPNCPY                         = 0xE43 // 3651
+	SYS_WCSNLEN                         = 0xE44 // 3652
+	SYS___STRSIGNAL_A                   = 0xE45 // 3653
+	SYS_FDOPENDIR                       = 0xE46 // 3654
+	SYS_FDCLOSEDIR                      = 0xE47 // 3655
+	SYS_SYSCALL                         = 0xE48 // 3656
 
 )
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux.go	2026-10-28 10:20:23.658875695 +0000
@@ -933,6 +933,29 @@
 
 const SizeofOpenHow = 0x18
 
+type NsIdReq struct {
+	Size       uint32
+	Spare      uint32
+	Ns_id      uint64
+	Ns_type    uint32
+	Spare2     uint32
+	User_ns_id uint64
+}
+
+const (
+	NS_ID_REQ_SIZE_VER0 = 0x20
+	LISTNS_CURRENT_USER = 0xffffffffffffffff
+
+	TIME_NS   = 0x80
+	MNT_NS    = 0x20000
+	CGROUP_NS = 0x2000000
+	UTS_NS    = 0x4000000
+	IPC_NS    = 0x8000000
+	USER_NS   = 0x10000000
+	PID_NS    = 0x20000000
+	NET_NS    = 0x40000000
+)
+
 const (
 	RESOLVE_BENEATH       = 0x8
 	RESOLVE_IN_ROOT       = 0x10
@@ -3579,7 +3602,7 @@
 	DEVLINK_ATTR_LINECARD_SUPPORTED_TYPES              = 0xae
 	DEVLINK_ATTR_NESTED_DEVLINK                        = 0xaf
 	DEVLINK_ATTR_SELFTESTS                             = 0xb0
-	DEVLINK_ATTR_MAX                                   = 0xb7
+	DEVLINK_ATTR_MAX                                   = 0xb9
 	DEVLINK_DPIPE_FIELD_MAPPING_TYPE_NONE              = 0x0
 	DEVLINK_DPIPE_FIELD_MAPPING_TYPE_IFINDEX           = 0x1
 	DEVLINK_DPIPE_MATCH_TYPE_FIELD_EXACT               = 0x0
@@ -4101,7 +4124,7 @@
 	ETHTOOL_A_COALESCE_RATE_SAMPLE_INTERVAL   = 0x17
 	ETHTOOL_A_COALESCE_USE_CQE_MODE_TX        = 0x18
 	ETHTOOL_A_COALESCE_USE_CQE_MODE_RX        = 0x19
-	ETHTOOL_A_COALESCE_MAX                    = 0x1e
+	ETHTOOL_A_COALESCE_MAX                    = 0x20
 	ETHTOOL_A_PAUSE_UNSPEC                    = 0x0
 	ETHTOOL_A_PAUSE_HEADER                    = 0x1
 	ETHTOOL_A_PAUSE_AUTONEG                   = 0x2
@@ -4113,7 +4136,7 @@
 	ETHTOOL_A_PAUSE_STAT_PAD                  = 0x1
 	ETHTOOL_A_PAUSE_STAT_TX_FRAMES            = 0x2
 	ETHTOOL_A_PAUSE_STAT_RX_FRAMES            = 0x3
-	ETHTOOL_A_PAUSE_STAT_MAX                  = 0x3
+	ETHTOOL_A_PAUSE_STAT_MAX                  = 0x4
 	ETHTOOL_A_EEE_UNSPEC                      = 0x0
 	ETHTOOL_A_EEE_HEADER                      = 0x1
 	ETHTOOL_A_EEE_MODES_OURS                  = 0x2
@@ -4537,9 +4560,12 @@
 )
 
 type LandlockRulesetAttr struct {
-	Access_fs  uint64
-	Access_net uint64
-	Scoped     uint64
+	Handled_access_fs  uint64
+	Handled_access_net uint64
+	Scoped             uint64
+	Quiet_access_fs    uint64
+	Quiet_access_net   uint64
+	Quiet_scoped       uint64
 }
 
 type LandlockPathBeneathAttr struct {
@@ -4569,28 +4595,31 @@
 	PIDFD_COREDUMP_USER        = 0x4
 	PIDFD_COREDUMP_ROOT        = 0x8
 	PIDFD_INFO_SIZE_VER0       = 0x40
-	PIDFD_GET_INFO             = 0xc048ff0b
+	PIDFD_GET_INFO             = 0xc058ff0b
 )
 
-const SizeofPidfdInfo = 0x48
+const SizeofPidfdInfo = 0x58
 
 type PidfdInfo struct {
-	Mask          uint64
-	Cgroupid      uint64
-	Pid           uint32
-	Tgid          uint32
-	Ppid          uint32
-	Ruid          uint32
-	Rgid          uint32
-	Euid          uint32
-	Egid          uint32
-	Suid          uint32
-	Sgid          uint32
-	Fsuid         uint32
-	Fsgid         uint32
-	Exit_code     int32
-	Coredump_mask uint32
-	_             uint32
+	Mask            uint64
+	Cgroupid        uint64
+	Pid             uint32
+	Tgid            uint32
+	Ppid            uint32
+	Ruid            uint32
+	Rgid            uint32
+	Euid            uint32
+	Egid            uint32
+	Suid            uint32
+	Sgid            uint32
+	Fsuid           uint32
+	Fsgid           uint32
+	Exit_code       int32
+	Coredump_mask   uint32
+	Coredump_signal uint32
+	Coredump_code   uint32
+	Coredump_pad    uint32
+	Supported_mask  uint64
 }
 
 const (
@@ -4932,7 +4961,7 @@
 	NL80211_ATTR_MAC_HINT                                   = 0xc8
 	NL80211_ATTR_MAC_MASK                                   = 0xd7
 	NL80211_ATTR_MAX_AP_ASSOC_STA                           = 0xca
-	NL80211_ATTR_MAX                                        = 0x15c
+	NL80211_ATTR_MAX                                        = 0x16e
 	NL80211_ATTR_MAX_CRIT_PROT_DURATION                     = 0xb4
 	NL80211_ATTR_MAX_CSA_COUNTERS                           = 0xce
 	NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS                     = 0x143
@@ -5147,12 +5176,12 @@
 	NL80211_ATTR_WOWLAN_TRIGGERS                            = 0x75
 	NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED                  = 0x76
 	NL80211_ATTR_WPA_VERSIONS                               = 0x4b
-	NL80211_AUTHTYPE_AUTOMATIC                              = 0x9
+	NL80211_AUTHTYPE_AUTOMATIC                              = 0xa
 	NL80211_AUTHTYPE_FILS_PK                                = 0x7
 	NL80211_AUTHTYPE_FILS_SK                                = 0x5
 	NL80211_AUTHTYPE_FILS_SK_PFS                            = 0x6
 	NL80211_AUTHTYPE_FT                                     = 0x2
-	NL80211_AUTHTYPE_MAX                                    = 0x8
+	NL80211_AUTHTYPE_MAX                                    = 0x9
 	NL80211_AUTHTYPE_NETWORK_EAP                            = 0x3
 	NL80211_AUTHTYPE_OPEN_SYSTEM                            = 0x0
 	NL80211_AUTHTYPE_SAE                                    = 0x4
@@ -5320,7 +5349,7 @@
 	NL80211_CMD_LEAVE_MESH                                  = 0x45
 	NL80211_CMD_LEAVE_OCB                                   = 0x6d
 	NL80211_CMD_LINKS_REMOVED                               = 0x9a
-	NL80211_CMD_MAX                                         = 0x9f
+	NL80211_CMD_MAX                                         = 0xa7
 	NL80211_CMD_MICHAEL_MIC_FAILURE                         = 0x29
 	NL80211_CMD_MODIFY_LINK_STA                             = 0x97
 	NL80211_CMD_NAN_MATCH                                   = 0x78
@@ -5566,7 +5595,7 @@
 	NL80211_FREQUENCY_ATTR_GO_CONCURRENT                    = 0xf
 	NL80211_FREQUENCY_ATTR_INDOOR_ONLY                      = 0xe
 	NL80211_FREQUENCY_ATTR_IR_CONCURRENT                    = 0xf
-	NL80211_FREQUENCY_ATTR_MAX                              = 0x27
+	NL80211_FREQUENCY_ATTR_MAX                              = 0x29
 	NL80211_FREQUENCY_ATTR_MAX_TX_POWER                     = 0x6
 	NL80211_FREQUENCY_ATTR_NO_10MHZ                         = 0x11
 	NL80211_FREQUENCY_ATTR_NO_160MHZ                        = 0xc
@@ -5639,7 +5668,7 @@
 	NL80211_IFTYPE_AKM_ATTR_SUITES                          = 0x2
 	NL80211_IFTYPE_AP                                       = 0x3
 	NL80211_IFTYPE_AP_VLAN                                  = 0x4
-	NL80211_IFTYPE_MAX                                      = 0xc
+	NL80211_IFTYPE_MAX                                      = 0xe
 	NL80211_IFTYPE_MESH_POINT                               = 0x7
 	NL80211_IFTYPE_MONITOR                                  = 0x6
 	NL80211_IFTYPE_NAN                                      = 0xc
@@ -5664,7 +5693,7 @@
 	NL80211_KEY_DEFAULT_TYPES                               = 0x8
 	NL80211_KEY_DEFAULT_TYPE_UNICAST                        = 0x1
 	NL80211_KEY_IDX                                         = 0x2
-	NL80211_KEY_MAX                                         = 0xa
+	NL80211_KEY_MAX                                         = 0xb
 	NL80211_KEY_MODE                                        = 0x9
 	NL80211_KEY_NO_TX                                       = 0x1
 	NL80211_KEY_RX_TX                                       = 0x0
@@ -5822,7 +5851,7 @@
 	NL80211_PMKSA_CANDIDATE_BSSID                           = 0x2
 	NL80211_PMKSA_CANDIDATE_INDEX                           = 0x1
 	NL80211_PMKSA_CANDIDATE_PREAUTH                         = 0x3
-	NL80211_PMSR_ATTR_MAX                                   = 0x5
+	NL80211_PMSR_ATTR_MAX                                   = 0x7
 	NL80211_PMSR_ATTR_MAX_PEERS                             = 0x1
 	NL80211_PMSR_ATTR_PEERS                                 = 0x5
 	NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR                    = 0x3
@@ -5831,7 +5860,7 @@
 	NL80211_PMSR_FTM_CAPA_ATTR_ASAP                         = 0x1
 	NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS                   = 0x6
 	NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT          = 0x7
-	NL80211_PMSR_FTM_CAPA_ATTR_MAX                          = 0x12
+	NL80211_PMSR_FTM_CAPA_ATTR_MAX                          = 0x1f
 	NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST           = 0x8
 	NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP                     = 0x2
 	NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED            = 0xa
@@ -5853,7 +5882,7 @@
 	NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD                  = 0x4
 	NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST                = 0x6
 	NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK                  = 0xc
-	NL80211_PMSR_FTM_REQ_ATTR_MAX                           = 0xe
+	NL80211_PMSR_FTM_REQ_ATTR_MAX                           = 0x17
 	NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED             = 0xb
 	NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP                = 0x3
 	NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES              = 0x7
@@ -5871,7 +5900,7 @@
 	NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON                  = 0x1
 	NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST               = 0x8
 	NL80211_PMSR_FTM_RESP_ATTR_LCI                          = 0x13
-	NL80211_PMSR_FTM_RESP_ATTR_MAX                          = 0x16
+	NL80211_PMSR_FTM_RESP_ATTR_MAX                          = 0x21
 	NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP               = 0x6
 	NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS            = 0x3
 	NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES           = 0x4
@@ -5885,7 +5914,7 @@
 	NL80211_PMSR_FTM_RESP_ATTR_TX_RATE                      = 0xb
 	NL80211_PMSR_PEER_ATTR_ADDR                             = 0x1
 	NL80211_PMSR_PEER_ATTR_CHAN                             = 0x2
-	NL80211_PMSR_PEER_ATTR_MAX                              = 0x4
+	NL80211_PMSR_PEER_ATTR_MAX                              = 0x5
 	NL80211_PMSR_PEER_ATTR_REQ                              = 0x3
 	NL80211_PMSR_PEER_ATTR_RESP                             = 0x4
 	NL80211_PMSR_REQ_ATTR_DATA                              = 0x1
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_386.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_386.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_386.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_386.go	2026-10-28 10:20:23.658875695 +0000
@@ -163,6 +163,11 @@
 	Flags      int32
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+}
+
 type Cmsghdr struct {
 	Len   uint32
 	Level int32
@@ -178,6 +183,7 @@
 	SizeofSockaddrNFCLLCP = 0x58
 	SizeofIovec           = 0x8
 	SizeofMsghdr          = 0x1c
+	SizeofMmsghdr         = 0x20
 	SizeofCmsghdr         = 0xc
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go	2026-10-28 10:20:23.658875695 +0000
@@ -166,6 +166,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -181,6 +187,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go	2026-10-28 10:20:23.658875695 +0000
@@ -169,6 +169,11 @@
 	Flags      int32
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+}
+
 type Cmsghdr struct {
 	Len   uint32
 	Level int32
@@ -184,6 +189,7 @@
 	SizeofSockaddrNFCLLCP = 0x58
 	SizeofIovec           = 0x8
 	SizeofMsghdr          = 0x1c
+	SizeofMmsghdr         = 0x20
 	SizeofCmsghdr         = 0xc
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go	2026-10-28 10:20:23.658875695 +0000
@@ -167,6 +167,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -182,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go	2026-10-28 10:20:23.658875695 +0000
@@ -167,6 +167,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -182,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go	2026-10-28 10:20:23.658875695 +0000
@@ -168,6 +168,11 @@
 	Flags      int32
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+}
+
 type Cmsghdr struct {
 	Len   uint32
 	Level int32
@@ -183,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x58
 	SizeofIovec           = 0x8
 	SizeofMsghdr          = 0x1c
+	SizeofMmsghdr         = 0x20
 	SizeofCmsghdr         = 0xc
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go	2026-10-28 10:20:23.658875695 +0000
@@ -167,6 +167,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -182,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go	2026-10-28 10:20:23.658875695 +0000
@@ -167,6 +167,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -182,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go	2026-10-28 10:20:23.658875695 +0000
@@ -168,6 +168,11 @@
 	Flags      int32
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+}
+
 type Cmsghdr struct {
 	Len   uint32
 	Level int32
@@ -183,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x58
 	SizeofIovec           = 0x8
 	SizeofMsghdr          = 0x1c
+	SizeofMmsghdr         = 0x20
 	SizeofCmsghdr         = 0xc
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go	2026-10-28 10:20:23.658875695 +0000
@@ -169,6 +169,11 @@
 	Flags      int32
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+}
+
 type Cmsghdr struct {
 	Len   uint32
 	Level int32
@@ -184,6 +189,7 @@
 	SizeofSockaddrNFCLLCP = 0x58
 	SizeofIovec           = 0x8
 	SizeofMsghdr          = 0x1c
+	SizeofMmsghdr         = 0x20
 	SizeofCmsghdr         = 0xc
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go	2026-10-28 10:20:23.658875695 +0000
@@ -168,6 +168,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -183,6 +189,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go	2026-10-28 10:20:23.658875695 +0000
@@ -168,6 +168,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -183,6 +189,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go	2026-10-28 10:20:23.658875695 +0000
@@ -167,6 +167,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -182,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go	2026-10-28 10:20:23.662875656 +0000
@@ -166,6 +166,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -181,6 +187,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go	2026-10-28 10:20:23.662875656 +0000
@@ -84,22 +84,20 @@
 
 type Stat_t struct {
 	Dev     uint64
-	_       uint16
 	Ino     uint64
+	Nlink   uint64
 	Mode    uint32
-	Nlink   uint32
 	Uid     uint32
 	Gid     uint32
+	_       uint32
 	Rdev    uint64
-	_       uint16
 	Size    int64
 	Blksize int64
 	Blocks  int64
 	Atim    Timespec
 	Mtim    Timespec
 	Ctim    Timespec
-	_       uint64
-	_       uint64
+	_       [3]int64
 }
 
 type Dirent struct {
@@ -170,6 +168,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -185,6 +189,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go /work/src/external-snapshotter/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go
--- a/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go	2026-10-28 10:19:50.871179627 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go	2026-10-28 10:20:23.662875656 +0000
@@ -209,6 +209,84 @@
 	Total_retrans  uint32
 }
 
+// Ptrace structures for z/OS
+
+type PtraceRegs struct {
+	Psw                      PtracePsw
+	Gprs                     [16]uint64
+	Acrs                     [16]uint32
+	Orig_gpr2                uint64
+	Fp_regs                  PtraceFpregs
+	Per_info                 PtracePer
+	Ieee_instruction_pointer uint64
+}
+
+type PtracePsw struct {
+	Mask uint64
+	Addr uint64
+}
+
+type PtraceFpregs struct {
+	Fpc  uint32
+	Fprs [16]float64
+}
+
+type PtracePer struct {
+	Control_regs  [3]uint64
+	_             [8]byte
+	Starting_addr uint64
+	Ending_addr   uint64
+	Perc_atmid    uint16
+	Address       uint64
+	Access_id     uint8
+	_             [7]byte
+}
+
+// PT_BLOCKREQ structures for block ptrace requests
+// Layout matches BPXYPTRC HLASM macro (PtBR_GPR + PtBR_GPR_EXT):
+//
+//	Offset 0-1:    Writebitflags (PtBR_GPR_CntlGPR, 2 bytes)
+//	Offset 2-3:    Wpsw (PtBR_GPR_CntlMisc, 2 bytes with WPSW bit flag)
+//	Offset 4-15:   Reserved (12 bytes)
+//	Offset 16-79:  Gpr (64 bytes, 16 GPRs)
+//	Offset 80-143: Ctl (64 bytes, 16 CRs)
+//	Offset 144-151: Psw old format (8 bytes, PtBR_GPR_PSW)
+//	Offset 152-167: Pswg extended (16 bytes, PtBR_GPR_PSWG for 64-bit)
+//	Total: 168 bytes (base 152 + extended 16)
+type PtraceBlkGpr struct {
+	Writebitflags uint16     // 2 bytes at offset 0 (PtBR_GPR_CntlGPR)
+	Wpsw          uint16     // 2 bytes at offset 2 (PtBR_GPR_CntlMisc with WPSW flag)
+	_             [12]byte   // 12 bytes reserved (offset 4-15)
+	Gpr           [16]uint32 // 64 bytes at offset 16 (GPRs)
+	Ctl           [16]uint32 // 64 bytes at offset 80 (CRs)
+	Psw           [8]byte    // 8 bytes at offset 144 (old PSW format)
+	Pswg          [16]byte   // 16 bytes at offset 152 (extended PSWG)
+	// Total: 2+2+12+64+64+8+16 = 168 bytes
+}
+
+type PtraceBlkReqReq struct {
+	Reqtype int32
+	Reqstat int32
+	Reqdata uint32
+	_       [4]byte
+}
+
+type PtraceBlkReq struct {
+	Numreq int32
+	_      [12]byte
+}
+
+// PT_READ_U structures for reading user area (control info)
+type PtraceBlkUarOcw struct {
+	Ofs uint32 // Control information offset
+	Ctl uint32 // Control information
+}
+
+type PtraceBlkUar struct {
+	Num uint32 // Number of entries
+	_   [4]byte
+}
+
 type _Gid_t uint32
 
 type rusage_zos struct {
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/sys/windows/types_windows_arm.go /work/src/external-snapshotter/vendor/golang.org/x/sys/windows/types_windows_arm.go
--- a/vendor/golang.org/x/sys/windows/types_windows_arm.go	2026-10-28 10:19:50.875179587 +0000
+++ b/vendor/golang.org/x/sys/windows/types_windows_arm.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,35 +0,0 @@
-// Copyright 2018 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package windows
-
-type WSAData struct {
-	Version      uint16
-	HighVersion  uint16
-	Description  [WSADESCRIPTION_LEN + 1]byte
-	SystemStatus [WSASYS_STATUS_LEN + 1]byte
-	MaxSockets   uint16
-	MaxUdpDg     uint16
-	VendorInfo   *byte
-}
-
-type Servent struct {
-	Name    *byte
-	Aliases **byte
-	Port    uint16
-	Proto   *byte
-}
-
-type JOBOBJECT_BASIC_LIMIT_INFORMATION struct {
-	PerProcessUserTimeLimit int64
-	PerJobUserTimeLimit     int64
-	LimitFlags              uint32
-	MinimumWorkingSetSize   uintptr
-	MaximumWorkingSetSize   uintptr
-	ActiveProcessLimit      uint32
-	Affinity                uintptr
-	PriorityClass           uint32
-	SchedulingClass         uint32
-	_                       uint32 // pad to 8 byte boundary
-}
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/text/secure/bidirule/bidirule.go /work/src/external-snapshotter/vendor/golang.org/x/text/secure/bidirule/bidirule.go
--- a/vendor/golang.org/x/text/secure/bidirule/bidirule.go	2026-10-28 10:19:50.883179509 +0000
+++ b/vendor/golang.org/x/text/secure/bidirule/bidirule.go	2026-10-28 10:20:23.834874002 +0000
@@ -10,6 +10,7 @@
 
 import (
 	"errors"
+	"sync"
 	"unicode/utf8"
 
 	"golang.org/x/text/transform"
@@ -246,8 +247,9 @@
 // Precomputing the ASCII values decreases running time for the ASCII fast path
 // by about 30%.
 var asciiTable [128]bidi.Properties
+var asciiTableOnce sync.Once
 
-func init() {
+func initASCIITable() {
 	for i := range asciiTable {
 		p, _ := bidi.LookupRune(rune(i))
 		asciiTable[i] = p
@@ -255,6 +257,8 @@
 }
 
 func (t *Transformer) advance(s []byte) (n int, ok bool) {
+	asciiTableOnce.Do(initASCIITable)
+
 	var e bidi.Properties
 	var sz int
 	for n < len(s) {
@@ -297,6 +301,8 @@
 }
 
 func (t *Transformer) advanceString(s string) (n int, ok bool) {
+	asciiTableOnce.Do(initASCIITable)
+
 	var e bidi.Properties
 	var sz int
 	for n < len(s) {
diff -Nur /work/src-orig/external-snapshotter/vendor/golang.org/x/text/unicode/bidi/core.go /work/src/external-snapshotter/vendor/golang.org/x/text/unicode/bidi/core.go
--- a/vendor/golang.org/x/text/unicode/bidi/core.go	2026-10-28 10:19:50.883179509 +0000
+++ b/vendor/golang.org/x/text/unicode/bidi/core.go	2026-10-28 10:20:23.834874002 +0000
@@ -208,27 +208,23 @@
 		p.matchingIsolateInitiator[i] = -1
 	}
 
+	var open []int
 	for i := range p.matchingPDI {
 		p.matchingPDI[i] = -1
 
-		if t := p.resultTypes[i]; t.in(LRI, RLI, FSI) {
-			depthCounter := 1
-			for j := i + 1; j < p.Len(); j++ {
-				if u := p.resultTypes[j]; u.in(LRI, RLI, FSI) {
-					depthCounter++
-				} else if u == PDI {
-					if depthCounter--; depthCounter == 0 {
-						p.matchingPDI[i] = j
-						p.matchingIsolateInitiator[j] = i
-						break
-					}
-				}
-			}
-			if p.matchingPDI[i] == -1 {
-				p.matchingPDI[i] = p.Len()
-			}
+		switch t := p.resultTypes[i]; {
+		case t.in(LRI, RLI, FSI):
+			open = append(open, i)
+		case t == PDI && len(open) > 0:
+			j := open[len(open)-1]
+			open = open[:len(open)-1]
+			p.matchingPDI[j] = i
+			p.matchingIsolateInitiator[i] = j
 		}
 	}
+	for _, i := range open {
+		p.matchingPDI[i] = p.Len()
+	}
 }
 
 // determineParagraphEmbeddingLevel reports the resolved paragraph direction of
@@ -496,16 +492,13 @@
 
 	// Rule W2.
 	// EN does not change at the start of the run, because sos != AL.
+	lastStrong := unknownClass
 	for i, t := range s.types {
-		if t == EN {
-			for j := i - 1; j >= 0; j-- {
-				if t := s.types[j]; t.in(L, R, AL) {
-					if t == AL {
-						s.types[i] = AN
-					}
-					break
-				}
-			}
+		switch {
+		case t.in(L, R, AL):
+			lastStrong = t
+		case t == EN && lastStrong == AL:
+			s.types[i] = AN
 		}
 	}
 
@@ -543,29 +536,30 @@
 	}
 
 	// Rule W5.
-	for i, t := range s.types {
-		if t == ET {
-			// locate end of sequence
-			runStart := i
-			runEnd := s.findRunLimit(runStart, ET)
-
-			// check values at ends of sequence
-			t := s.sos
-			if runStart > 0 {
-				t = s.types[runStart-1]
+	for i := 0; i < len(s.types); i++ {
+		if s.types[i] != ET {
+			continue
+		}
+		// locate end of sequence
+		runStart := i
+		runEnd := s.findRunLimit(runStart, ET)
+
+		// check values at ends of sequence
+		t := s.sos
+		if runStart > 0 {
+			t = s.types[runStart-1]
+		}
+		if t != EN {
+			t = s.eos
+			if runEnd < len(s.types) {
+				t = s.types[runEnd]
 			}
-			if t != EN {
-				t = s.eos
-				if runEnd < len(s.types) {
-					t = s.types[runEnd]
-				}
-			}
-			if t == EN {
-				setTypes(s.types[runStart:runEnd], EN)
-			}
-			// continue at end of sequence
-			i = runEnd
 		}
+		if t == EN {
+			setTypes(s.types[runStart:runEnd], EN)
+		}
+		// continue at end of sequence
+		i = runEnd
 	}
 
 	// Rule W6.
@@ -576,20 +570,13 @@
 	}
 
 	// Rule W7.
+	prevStrongType := s.sos
 	for i, t := range s.types {
-		if t == EN {
-			// set default if we reach start of run
-			prevStrongType := s.sos
-			for j := i - 1; j >= 0; j-- {
-				t = s.types[j]
-				if t == L || t == R { // AL's have been changed to R
-					prevStrongType = t
-					break
-				}
-			}
-			if prevStrongType == L {
-				s.types[i] = L
-			}
+		switch {
+		case t == L || t == R: // AL's have been changed to R
+			prevStrongType = t
+		case t == EN && prevStrongType == L:
+			s.types[i] = L
 		}
 	}
 }
diff -Nur /work/src-orig/external-snapshotter/vendor/modules.txt /work/src/external-snapshotter/vendor/modules.txt
--- a/vendor/modules.txt	2026-10-28 10:19:51.107177302 +0000
+++ b/vendor/modules.txt	2026-10-28 10:20:26.054852862 +0000
@@ -393,14 +393,14 @@
 # go.yaml.in/yaml/v3 v3.0.5
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
-# golang.org/x/crypto v0.57.0
+# golang.org/x/crypto v0.58.0
 ## explicit; go 1.26.0
 golang.org/x/crypto/cryptobyte
 golang.org/x/crypto/cryptobyte/asn1
 # golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba
 ## explicit; go 1.26.0
 golang.org/x/exp/slices
-# golang.org/x/net v0.59.0
+# golang.org/x/net v0.60.0 => golang.org/x/net v0.62.0
 ## explicit; go 1.26.0
 golang.org/x/net/http/httpguts
 golang.org/x/net/http2
@@ -415,19 +415,19 @@
 ## explicit; go 1.26.0
 golang.org/x/oauth2
 golang.org/x/oauth2/internal
-# golang.org/x/sync v0.23.0
+# golang.org/x/sync v0.24.0
 ## explicit; go 1.26.0
 golang.org/x/sync/singleflight
-# golang.org/x/sys v0.48.0
+# golang.org/x/sys v0.49.0
 ## explicit; go 1.26.0
 golang.org/x/sys/plan9
 golang.org/x/sys/unix
 golang.org/x/sys/windows
 golang.org/x/sys/windows/registry
-# golang.org/x/term v0.46.0
+# golang.org/x/term v0.47.0
 ## explicit; go 1.26.0
 golang.org/x/term
-# golang.org/x/text v0.42.0
+# golang.org/x/text v0.43.0
 ## explicit; go 1.26.0
 golang.org/x/text/cases
 golang.org/x/text/feature/plural
@@ -1343,3 +1343,4 @@
 # k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.37.0
 # k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.37.0
 # k8s.io/sample-controller => k8s.io/sample-controller v0.37.0
+# golang.org/x/net => golang.org/x/net v0.62.0
