54986: actually prevent FDT_MODULE fds from being closed by user

The stated goal of FDT_MODULE is:
  /*
   * Entry visible to other processes but controlled by a module.
   * The difference from FDT_EXTERNAL is that closing this using
   * standard fd syntax will fail as there is some tidying up that
   * needs to be done by the module's own mechanism.
   */
  #define FDT_MODULE		3

but this wasn't actually enforced. By accident, some fds ended up as
FDT_INTERNAL because movefd clobbers the FDT_MODULE value and those were
protected from closing. I think this straightens out all the bits
properly, at least the ones I found.

(Note that zsocket is using FDT_EXTERNAL purposefully because the user
*is* expected to close those fds with the {myfd}>&- syntax, it has no
specific interface to close opened sockets since it has no internal
state for them.)

Both zsocket and ztcp forgot to movefd the some of their fds which meant
it was potentially in the 0-9 range, which is also not protected from
being closed by the user, but:

Since the -d flag allows the user to put module fds at low fds, I made
the check forbid closing FDT_MODULE fds in that range too, I think
that's correct?

zftp did some very questionable things, relying on FDT_UNUSED fds to act
approximately like it expected, instead use FDT_MODULE there too.

Also make redup ensure the fdtable is big enough for the assignments
after, just for consistency, since the old addmodulefd call before
didn't necessarily grow it to the moved-to fd number.

Remove some misleading comments like
/* move the fd since no one will want to read from it */
the reason we move the fd is because we have promised the user we will
not open fds in the 0-9 range.

Also added maximum macro, and converted existing users of MIN/MAX to
them, since we have not, as far as I can tell, made any effort to check
that those macros are in fact defined by anyone.

1 files changed, 7 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index ce85369b7..2287db1bd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2026-07-25  Mikael Magnusson  <mikachu@gmail.com>
+
+	* 54986: Src/Modules/socket.c, Src/Modules/tcp.c,
+	Src/Modules/zftp.c, Src/exec.c, Src/params.c, Src/utils.c,
+	Src/zsh.h: actually prevent FDT_MODULE fds from being closed
+	by user
+
 2026-07-21  Mikael Magnusson  <mikachu@gmail.com>
 
 	* 54985: Src/Zle/zle_main.c, Src/hist.c, Src/zsh.h: fix crash