So recvmsg(2) says that if you receive a Unix socket message and its ancillary data does not fit in the buffer, it still returns success but sets MSG_CTRUNC in the output flags. A bit error-prone, but OK. What it doesn't tell you is that if you receive file descriptors in the ancillary data (SCM_RIGHTS) and the Linux security subsystem decides that you don't have access to those file descriptors, it just removes them from the list and sets MSG_CTRUNC. Took a long time to figure out...