For directories, f-dir->fd is *the* file descriptor associated with that directory, so doing a fstatat(f->dir->fd, f->fpath) was trying to do a lookup for f->fpath (the directory name) *inside* the directory itself. bug spotted by cage, thanks!

the strerror_r(3) man page mentions that it returns a message that's up to NL_TEXTMAX bytes long (including the NUL.) strerror_r can fail with ERANGE if the buffer is not large enough, and that's probably the case of some "funny" Rerrors that cage gets from time to time.