[BHznJNs]

Android application seccomp policies can terminate the process with SIGSYS when unix.Fchmodat(..., AT_SYMLINK_NOFOLLOW) probes fchmodat2. This was observed while extracting an OCI layer through gomobile on Android 16 / arm64 (Motorola XT2533-4): seccomp rejected syscall 452. Since the syscall never returns, the existing EOPNOTSUPP fallback cannot run.

Select the existing chmod fallback before probing on Android. This retains its bounded parent descriptor and O_PATH/O_NOFOLLOW handling; other platforms keep the existing probe and error handling. Add a regression test for both uncompressed TAR extraction entry points, covering executable and write-only files, sticky directories, and preservation of a symlink and its target's permissions.

Validation with Go 1.26.10:

• Full Windows test suite passed.
• Full Linux test suite passed in Debian WSL, both as an unprivileged user and as root.
• go vet ./... passed for Windows and Linux.
• An isolated gomobile APK (native API 28, target SDK 36) passed the new permissions regression and all 14 android-containerregistry integration tests under an ordinary app UID on the affected Android 16 / arm64 device. The integration tests cover traversal rejection, whiteouts, hardlink copies, cancellation, and rollback.
• The same app successfully pulled and extracted docker.io/library/alpine:3.20 for arm64: 517 TAR entries, 8,817,851 unpacked bytes, without SIGSYS.

The Android device checks used golang.org/x/sys v0.49.0, matching the original report. Device validation is limited to this Android 16 / arm64 device.