To preempt the sashiko stuff, both are false positives: 1. The per-process RLIMIT_MEMLOCK limit is on purpose, it's what you'd expect, it matches what io_uring and every other use of the pattern does, and it's strictly _more_ limiting as it's per-process limit vs. total inode usage.
2. It doesn't support fallocate so hole-punching isn't an issue. Pseudo-inodes are used so you can't drop_caches (which is a privileged operation anyway) and secretmem_release() will be called eventually regardless of how things are discarded so there's no possibility of an imbalance. -- Cheers, Lorenzo
