CVE-2021-3999: glibc getcwd off-by-one buffer underflow/overflow (size==1)

CVE-2021-3999 is an off-by-one buffer underflow AND overflow in glibc's __getcwd_generic() function (sysdeps/posix/getcwd.c) when called with size==1 under specific filesystem conditions.

Three conditions must hold simultaneously:

1. getcwd(buf, 1) is called — size == 1
2. The current working directory path is longer than PATH_MAX
3. '/' is bind-mounted onto the current working directory (making thisdev==rootdev && thisino==rootino immediately true in the directory traversal)

The Linux kernel's getcwd syscall checks path name length BEFORE checking buffer size, so for paths longer than PATH_MAX it returns ENAMETOOLONG (not ERANGE). The condition errno == ENAMETOOLONG in sysdeps/unix/sysv/linux/getcwd.c line 101 triggers a fallback to __getcwd_generic(path, 1) with size=1.