Returning an error is better but you're using ssize_t which is a tradeoff. The race conditions appear to be a result of the Linux kernel implementation but UNI

Returning an error is better but you're using ssize_t which is a tradeoff. The race conditions appear to be a result of the Linux kernel implementation but UNIX style syscalls introduce these races by default. It is not an inherent flaw of the API or even the implementation Linux was using. The only useable C string API has always been memcpy anyways.