Function open_at 

pub fn open_at(
    dir_fd: u64,
    path: &str,
    flags: OpenFlags,
) -> Result<u32, SyscallError>

Open a file relative to a directory FD.

• If dir_fd == AT_FDCWD, resolve against the process CWD (equivalent to open()).
• Otherwise, resolve against the path of the given directory FD.

This is the foundation for capability-based path resolution: the directory FD acts as the root of the namespace for this operation, naturally preventing ../ escapes beyond the FD’s subtree.