Fix unchecked kevent return values in kqueue ASIO backend

The kqueue backend silently ignored failures when registering event
filters. With a NULL eventlist, kevent stops on the first changelist
failure, leaving partial registrations and no actor notification. Actors
that thought they were subscribed would wait forever.

Use EV_RECEIPT so all changelist entries are processed regardless of
individual failures, and send ASIO_ERROR to the owning actor on
subscription failure. All seven stdlib AsioEventNotify consumers handle
the new flag by tearing down through their existing fatal-error paths.

Also fixes unchecked pipe() and kevent() returns in
ponyint_asio_backend_init, removes dead EV_ERROR code from the dispatch
loop, and adds missing ponyint_messageq_destroy on kqueue() failure.

Closes #5051

Author: SeanTAllen

.release-notes/fix-unchecked-kevent-returns.md

@@ -0,0 +1,19 @@
+## Fix unchecked kevent return values in kqueue ASIO backend
+
+On macOS and BSD, the kqueue ASIO backend silently ignored failures when registering event filters. When `pony_asio_event_subscribe` submitted multiple filters (e.g., READ and WRITE) and one failed, the remaining filters were never registered. The actor had no way to detect this, resulting in events that would never fire and connections that would hang indefinitely.
+
+The backend now uses `EV_RECEIPT` to ensure all filter registrations are processed regardless of individual failures, and sends a new `ASIO_ERROR` notification to the owning actor when a subscription fails. All stdlib consumers (`TCPConnection`, `TCPListener`, `UDPSocket`, `Stdin`, `ProcessMonitor`, `SignalHandler`, `Timers`) treat `ASIO_ERROR` as a fatal event and tear down, the same as any other I/O failure.
+
+If you implement `AsioEventNotify` outside the stdlib, you should add handling for `ASIO_ERROR`. Without it, a subscription failure is silently ignored (the same behavior as before this fix, but now you have the option to detect it).
+
+The `AsioEvent` primitive gains a new `errored` predicate method for checking the flag:
+
+```pony
+be _event_notify(event: AsioEventID, flags: U32, arg: U32) =>
+  if AsioEvent.errored(flags) then
+    // Subscription failed — tear down
+    _close()
+    return
+  end
+  // ... normal event handling
+```

packages/builtin/asio_event.pony

@@ -31,6 +31,14 @@ primitive AsioEvent
     """
     flags == 0
 
+  fun errored(flags: U32): Bool =>
+    """
+    Returns true if the flags contain the error flag, indicating a
+    subscription failure. The event is compromised and the actor should
+    tear down.
+    """
+    (flags and (1 << 4)) != 0
+
   fun oneshotable(flags: U32): Bool =>
     """
     Returns true if the flags contain the oneshot flag.

packages/builtin/stdin.pony

@@ -122,6 +122,10 @@ actor Stdin is AsioEventNotify
     """
     if AsioEvent.disposable(flags) then
       @pony_asio_event_destroy(event)
+    elseif (_event is event) and AsioEvent.errored(flags) then
+      _close_event()
+      try (_notify as InputNotify).dispose() end
+      _notify = None
     elseif (_event is event) and AsioEvent.readable(flags) then
       _read()
     end

packages/net/tcp_connection.pony

@@ -638,6 +638,22 @@ actor TCPConnection is AsioEventNotify
           @pony_os_socket_close(fd)
           _try_shutdown()
         end
+      elseif AsioEvent.errored(flags) then
+        // A subscription failure on a connection attempt.
+        var fd = @pony_asio_event_fd(event)
+        _connect_count = _connect_count - 1
+
+        if not _connected and not _closed then
+          @pony_asio_event_unsubscribe(event)
+          @pony_os_socket_close(fd)
+          _notify_connecting()
+        else
+          if not @pony_asio_event_get_disposable(event) then
+            @pony_asio_event_unsubscribe(event)
+          end
+          @pony_os_socket_close(fd)
+          _try_shutdown()
+        end
       else
         // It's not our event.
         if AsioEvent.disposable(flags) then
@@ -647,6 +663,11 @@ actor TCPConnection is AsioEventNotify
       end
     else
       // At this point, it's our event.
+      if AsioEvent.errored(flags) then
+        hard_close()
+        return
+      end
+
       if AsioEvent.writeable(flags) then
         _writeable = true
         _complete_writes(arg)

packages/net/tcp_listener.pony

@@ -150,6 +150,11 @@ actor TCPListener is AsioEventNotify
       return
     end
 
+    if AsioEvent.errored(flags) then
+      close()
+      return
+    end
+
     if AsioEvent.readable(flags) then
       _accept(arg)
     end

packages/net/udp_socket.pony

@@ -261,6 +261,11 @@ actor UDPSocket is AsioEventNotify
     end
 
     if not _closed then
+      if AsioEvent.errored(flags) then
+        _close()
+        return
+      end
+
       if AsioEvent.readable(flags) then
         _readable = true
         _complete_reads(arg)

packages/process/process_monitor.pony

@@ -221,6 +221,11 @@ actor ProcessMonitor is AsioEventNotify
     """
     Handle the incoming Asio event from one of the pipes.
     """
+    if AsioEvent.errored(flags) then
+      _close()
+      return
+    end
+
     match event
     | _stdin.event =>
       if AsioEvent.writeable(flags) then

packages/signals/signal_handler.pony

@@ -45,6 +45,8 @@ actor SignalHandler is AsioEventNotify
     """
     if AsioEvent.disposable(flags) then
       @pony_asio_event_destroy(event)
+    elseif (event is _event) and AsioEvent.errored(flags) then
+      _dispose()
     elseif event is _event then
       if not _notify(arg) then
         _dispose()

packages/time/timers.pony

@@ -81,6 +81,13 @@ actor Timers is AsioEventNotify
     """
     if AsioEvent.disposable(flags) then
       @pony_asio_event_destroy(event)
+    elseif (event is _event) and AsioEvent.errored(flags) then
+      for wheel in _wheel.values() do
+        wheel.clear()
+      end
+      _map.clear()
+      @pony_asio_event_unsubscribe(_event)
+      _event = AsioEvent.none()
     elseif event is _event then
       _advance()
     end

src/libponyrt/asio/asio.h

@@ -32,6 +32,7 @@ enum
   ASIO_WRITE = 1 << 1,
   ASIO_TIMER = 1 << 2,
   ASIO_SIGNAL = 1 << 3,
+  ASIO_ERROR = 1 << 4,
   ASIO_ONESHOT = 1 << 8,
   ASIO_DESTROYED = (uint32_t)-1
 };