Ret was uint32_t truncating the uint64_t __readlink return, and was compared against the unrelated getdents64 BufSize (1024) instead of sizeof(TargetPath) (NameMax, 4096). A truncated readlink of exactly NameMax bytes also wrote one byte past TargetPath.