Function rewrite_attached_ids 

unsafe fn rewrite_attached_ids(
    fd: c_int,
    rc: c_int,
    req: c_ulong,
    arg: *mut c_void,
)

Scrub the hidden GPUs out of a successful GET_ATTACHED_IDS / GET_PROBED_IDS response so the NVIDIA libraries never try to peer-init a GPU the container cannot reach: it drops every id whose /dev/nvidia node is absent. Split from filtered_ioctl so the whole thing runs under catch_unwind.

The guards run cheap-to-expensive and each returns early — leaving the response untouched — the moment one fails, so the overwhelmingly common non-enumeration ioctl pays almost nothing:

1. Request gate: the syscall succeeded (rc == 0), arg is non-null, and the request is the RM_CONTROL ioctl matched by DIR|TYPE|NR (size-agnostic, via ioc_no_size).
2. fd identity gate: when NVIDIACTL_RDEV was resolved at install, fstat the fd and require a character device whose rdev equals /dev/nvidiactl’s — so only that char device’s responses are rewritten. An fstat failure passes through untouched; if the rdev was never resolved the gate is skipped and matching relies on the request/size checks alone.
3. Payload gate: the RM call itself reports success (ctrl.status == 0) and carries a parameter pointer (ctrl.params != 0).
4. Command + exact-size dispatch: cmd selects ATTACHED or PROBED, and params_size must equal that command’s exact struct size. Requiring the exact size both disambiguates the two (their layouts share a leading array) and stops a lying size from steering a rewrite under a different layout. Both APIs are filtered so behavior is uniform across driver versions — buggy 570-595 where it actually drops GPUs, and correct drivers where the strict-subset rule makes it a no-op.
5. Filter the leading gpuIds[32]: filter_ids keeps an id only when gpuid_to_minor resolves it and the corresponding /dev/nvidia node is present. For PROBED the trailing excludedGpuIds[] is deliberately left untouched (it lists GPUs to exclude, not to use).

When PIXELFLUX_GPU_FILTER_DEBUG is set, the before/after live-id counts are logged.