the strerror_r(3) man page mentions that it returns a message that's up to NL_TEXTMAX bytes long (including the NUL.) strerror_r can fail with ERANGE if the buffer is not large enough, and that's probably the case of some "funny" Rerrors that cage gets from time to time.

we can't call unlinkat with `.' as path, so the hackish solution (but also the only viable one I can see) is to unlinkat ../<dirname>. Furthermore, calling unlinkat(f->dir->fd, f->fpath) was incorrect because f->dir->fd already points to the directory.

I've been using the qid both as the 9p protocol element *and* as a wrapper with refcounting around a directory file descriptor. I can do better, let's split the qid struct into a "proper" qid and dir. Dir is now the wrapper with refcounting around the directory file descriptor and qid is just the 9p struct. fids are still associated with a dir, but now they store the directory name if they point to the directory. The previous pattern to detect if a fid is pointing to a dir thus changed: instead of assuming that fpath is "", look at the qid struct.