Handle vsock spurious wakeups gracefully instead of asserting

Sources/NIOPosix/BaseSocketChannel.swift

@@ -1201,9 +1201,20 @@ class BaseSocketChannel<SocketType: BaseSocketProtocol>: SelectableChannel, Chan
         // The only way to avoid that race, would be to use heavy handed synchronisation primitives like IOSQE_IO_DRAIN (basically
         // flushing all pending requests and wait for a fake event result to sync up) which would be awful for performance,
         // so better skip the assert() for io_uring instead.
-        #if !SWIFTNIO_USE_IO_URING
-        assert(readResult == .some)
-        #endif
+
+        // NOTE: The original assert assumed kqueue/epoll always have implicit sync,
+        // but vsock (virtual sockets) may not provide the same guarantees as regular
+        // TCP/Unix sockets. Handle .none gracefully instead of crashing.
+        // See: https://github.com/apple/swift-nio/issues/3500
+        //      https://github.com/apple/containerization/issues/503
+        if readResult == .none {
+            // Spurious wakeup - no data available despite POLLIN notification.
+            // This can happen with vsock or other non-standard socket types that
+            // don't have the same kqueue synchronization guarantees.
+            self.readIfNeeded0()
+            return .normal(.none)
+        }
+
         if self.lifecycleManager.isActive {
             self.pipeline.syncOperations.fireChannelReadComplete()
         }

Sources/NIOPosix/SelectableEventLoop.swift

@@ -878,7 +878,20 @@ internal final class SelectableEventLoop: EventLoop, @unchecked Sendable {
             } while !drained && iterations < 1000
             precondition(drained, "EventLoop \(self) didn't quiesce after 1000 ticks.")
 
+            // NOTE: On Darwin, vsock (virtual sockets) used by Apple's Containerization
+            // framework can cause the event loop to exit abnormally when the hypervisor
+            // closes connections. In this case, the state machine may not have transitioned
+            // to .noLongerRunning. We handle this gracefully instead of asserting.
+            // See: https://github.com/apple/swift-nio/issues/3500
+            //      https://github.com/apple/containerization/issues/503
+            #if canImport(Darwin)
+            if self.internalState != .noLongerRunning {
+                // Abnormal exit (likely vsock disconnection) - force state transition
+                self.internalState = .noLongerRunning
+            }
+            #else
             assert(self.internalState == .noLongerRunning, "illegal state: \(self.internalState)")
+            #endif
             self.internalState = .exitingThread
         }
         var nextReadyDeadline: NIODeadline? = nil

Sources/NIOPosix/System.swift

@@ -196,7 +196,14 @@ func isUnacceptableErrno(_ code: CInt) -> Bool {
     // is valid but the accepted one is not. The right solution here is to perform a check for
     // SO_ISDEFUNCT when we see this happen, but we haven't yet invested the time to do that.
     // In the meantime, we just tolerate EBADF on iOS.
-    #if canImport(Darwin) && !os(macOS)
+    //
+    // NOTE: We now also tolerate EBADF on macOS because vsock (virtual sockets) used by
+    // Apple's Containerization framework can experience similar file descriptor invalidation
+    // issues. The vsock hypervisor layer may close descriptors in ways that cause EBADF
+    // during normal operation.
+    // See: https://github.com/apple/swift-nio/issues/3500
+    //      https://github.com/apple/containerization/issues/503
+    #if canImport(Darwin)
     switch code {
     case EFAULT:
         return true
@@ -216,18 +223,34 @@ func isUnacceptableErrno(_ code: CInt) -> Bool {
 @inlinable
 public func isUnacceptableErrnoOnClose(_ code: CInt) -> Bool {
     // We treat close() differently to all other FDs: we still want to catch EBADF here.
+    // NOTE: On Darwin, we tolerate EBADF because vsock (virtual sockets) used by
+    // Apple's Containerization framework can have file descriptors invalidated by
+    // the hypervisor layer during normal operation, causing EBADF on close.
+    // See: https://github.com/apple/swift-nio/issues/3500
+    //      https://github.com/apple/containerization/issues/503
+    #if canImport(Darwin)
+    switch code {
+    case EFAULT:
+        return true
+    default:
+        return false
+    }
+    #else
     switch code {
     case EFAULT, EBADF:
         return true
     default:
         return false
     }
+    #endif
 }
 
 @inlinable
 internal func isUnacceptableErrnoForbiddingEINVAL(_ code: CInt) -> Bool {
     // We treat read() and pread() differently since we also want to catch EINVAL.
-    #if canImport(Darwin) && !os(macOS)
+    // NOTE: We tolerate EBADF on all Darwin platforms (not just iOS) because vsock
+    // can cause file descriptor invalidation on macOS as well.
+    #if canImport(Darwin)
     switch code {
     case EFAULT, EINVAL:
         return true