The byte capacity of stdout's allocated buffer, given whether stat succeeded and the block size it reported. As filedoalloc.c, for the selected stdout descriptor 1 and the pinned x86-64 _STATBUF_ST_BLKSIZE configuration: use a positive st_blksize smaller than BUFSIZ (8192) only after a successful stat; otherwise retain BUFSIZ. This is NOT the capacity function for arbitrary descriptors.

The capacity is always positive and at most 8192 bytes, so the buffer request is never too big.

Where stdout's buffer lives: no buffer yet, the one-byte buffer embedded in the FILE (_shortbuf), or a heap buffer of size bytes at base.

Why libio picks a buffer: one already exists, the stream is unbuffered, malloc returned base, or malloc returned NULL. These causes describe libio's control flow, not R.alloc's result. MallocNull is useful for generic libio, but is excluded at this pin. Unbuffered is for a byte stream: wide orientation takes another path.

Generic libio's buffer choice, from the old storage for a cause to the new: an existing buffer is kept; with no buffer, an unbuffered stream or a NULL malloc falls back to the embedded byte, and a successful malloc gives a heap buffer of the given capacity.

The pin's buffer choice: a buffer_choice whose cause is not a NULL malloc, since this glibc's malloc ends the run on refusal instead.

The pointers, with their capabilities, through which stdout's state is reached: the FILE, its lock, and errno.

The writable spans of the FILE, lock and errno. stdfiles.c allocates _IO_FILE_plus: FILE (216) plus its vtable pointer (8). NPTL's lock is { int lock; int cnt; void *owner; }. errno is a separate four-byte TLS cell. These spans are authority supplied by the caller of the trusted boundary, never inferred just from the addresses stored in FILE.

A pointer to the FILE's embedded one-byte buffer (_shortbuf, at offset 131), with the FILE's own capability.

The span of the buffer the storage names: none, the embedded byte, or the heap buffer with an Obj capability for its base.

All of stdout's writable roots: the fixed_roots, plus a heap buffer's span. The embedded byte needs no root of its own: it is inside the FILE's.

In memory m, the FILE's _IO_buf_base and _IO_buf_end slots (offsets 56 and 64) hold, as a pointer_slot with address bytes and auxaux Fil-CAn object's aux allocation, as large as its payload: where Fil-C keeps the lowers of the pointers stored in the object, slot for slot, while their intvals sit in the object's bytes. The aux word in the object header points at it; it is null for an object no pointer was ever stored into, which the collector then scans as a leaf. A pointer store must *ensure* it exists, which may call the runtime; a pointer load reads it., the start and end of the storage's buffer, or null when there is none. The end pointer keeps the buffer's capability.

Memory m holds stdout's selected state for roots r and storage:

• every root of memory_roots is a writable_span;
• the whole FILE and its three pointer slots (56, 64 and the lock slot 136) are readable, 8-aligned; the lock and errno writable;
• the lock slot points at the lock, and buffer_slots holds;
• a heap buffer is nonempty and a live heap object.

This view supplies actual address bytes and auxaux Fil-CAn object's aux allocation, as large as its payload: where Fil-C keeps the lowers of the pointers stored in the object, slot for slot, while their intvals sit in the object's bytes. The aux word in the object header points at it; it is null for an object no pointer was ever stored into, which the collector then scans as a leaf. A pointer store must *ensure* it exists, which may call the runtime; a pointer load reads it., not a detached logical list of roots. Heap kind, liveness and buffer bounds are checked independently of the two pointer slots. It intentionally does not describe ownership, flags, orientation, pending bytes or lock state. These are selected roots, NOT a complete puts footprint: storing THREAD_SELF in lock.owner needs another capability source.

The stdio_world this view gives: a usable stdout whose roots are memory_roots.

Where stdout_memory holds, its world is stdio_ready, as puts_pre requires.

Where the fixed roots are writable, the embedded buffer's capability is available from them and its byte is under their write authority: it neither allocates nor expands root authority. Its one byte is already inside the FILE root, with the SAME capability.

This is _IO_setb's selected no-old-buffer case. The two pointer stores change bytes AND aux; the four-byte flags store changes only _IO_USER_BUF. No release is hidden in this construction. Selection of this path still needs NoBuffer and backend/mode premises.