Function filtered_ioctl 

unsafe extern "C" fn filtered_ioctl(
    fd: c_int,
    req: c_ulong,
    arg: *mut c_void,
) -> c_int

The seam where a hidden GPU gets scrubbed out: the ioctl wrapper installed into the NVIDIA libraries’ GOT slots, which forwards to the real libc::ioctl and then post-processes the response. The three steps below exist only to make interposing on ioctl safe:

1. Call through: invoke the genuine libc::ioctl. Only this crate’s own GOT is left unpatched, so this inner call resolves to libc rather than back into this wrapper (no recursion).
2. Filter the result under catch_unwind: rewrite_attached_ids may drop hidden GPUs from the response. A panic must never unwind across this extern "C" boundary — the compiler guard would abort the whole process — so any panic is caught and the unmodified real result is returned instead.
3. Preserve errno: the real syscall’s errno is saved before the /proc + /dev lookups inside the filter and restored afterward, so a caller reading errno sees the syscall’s value.