Verify socket ownership before treating a vGPU claimant PID as live

A bare kill(0) check treats any process that reused a stored hypervisor
PID as the owning VMM, so a reused PID could keep an orphaned VF in the
startup protected set or make a stale record look like a live claim
during release. Require the PID to own the instance's hypervisor socket
on Linux in both paths.

Also retain assignment metadata when start's vGPU rollback fails,
matching create and stop, so later release paths can still find the
device path instead of leaking the slot until the next restart.

Author: yummybomb

cmd/api/main.go

@@ -174,7 +174,7 @@ func liveInstanceVGPUDevicePaths(ctx context.Context, instanceManager instances.
 		if inst.GPUDevicePath == "" || inst.HypervisorPID == nil {
 			continue
 		}
-		if !instances.ProcessExists(*inst.HypervisorPID) {
+		if !instances.HypervisorProcessExists(*inst.HypervisorPID, inst.SocketPath) {
 			continue
 		}
 		protected[inst.GPUDevicePath] = struct{}{}

lib/instances/lifecycle_noop_test.go

@@ -3,6 +3,7 @@ package instances
 import (
 	"context"
 	"errors"
+	"net"
 	"os"
 	"path/filepath"
 	"sync"
@@ -183,14 +184,18 @@ func TestDeleteDropsStaleVGPUClaimedByLiveInstance(t *testing.T) {
 	claimantID := "inst-live-claimant"
 	require.NoError(t, m.ensureDirectories(claimantID))
 	pid := os.Getpid()
+	socketPath := m.paths.InstanceSocket(claimantID, "noop.sock")
+	listener, err := net.Listen("unix", socketPath)
+	require.NoError(t, err)
+	defer listener.Close()
 	require.NoError(t, m.saveMetadata(&metadata{StoredMetadata: StoredMetadata{
 		Id:             claimantID,
 		Name:           claimantID,
 		Image:          "test-image",
 		CreatedAt:      now,
 		HypervisorType: lifecycleNoopHypervisorType,
 		HypervisorPID:  &pid,
-		SocketPath:     m.paths.InstanceSocket(claimantID, "noop.sock"),
+		SocketPath:     socketPath,
 		DataDir:        m.paths.InstanceDir(claimantID),
 		GPUProfile:     "NVIDIA L40S-2Q",
 		GPUFramework:   devices.VGPUFramework("future-framework"),

lib/instances/process_identity_linux_test.go

@@ -0,0 +1,17 @@
+//go:build linux
+
+package instances
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestHypervisorProcessExistsRejectsLivePIDWithoutSocketOwnership(t *testing.T) {
+	t.Parallel()
+
+	assert.False(t, HypervisorProcessExists(os.Getpid(), filepath.Join(t.TempDir(), "missing.sock")))
+}

lib/instances/query.go

@@ -587,6 +587,23 @@ func refreshHypervisorPID(stored *StoredMetadata, state State) {
 	}
 }
 
+// HypervisorProcessExists reports whether pid owns the instance's hypervisor
+// socket. On Linux this distinguishes a surviving hypervisor from an unrelated
+// process that reused its PID.
+func HypervisorProcessExists(pid int, socketPath string) bool {
+	if !ProcessExists(pid) {
+		return false
+	}
+	if runtime.GOOS != "linux" {
+		return true
+	}
+	if socketPath == "" {
+		return false
+	}
+	resolvedPID, err := hypervisor.ResolveProcessPID(socketPath)
+	return err == nil && resolvedPID == pid
+}
+
 // ProcessExists reports whether pid belongs to a live, non-zombie process.
 func ProcessExists(pid int) bool {
 	if pid <= 0 {

lib/instances/start.go

@@ -178,6 +178,9 @@ func (m *manager) startInstance(
 			}
 			if err := devices.DestroyVGPU(ctx, assignment); err != nil {
 				log.WarnContext(ctx, "failed to destroy vGPU on cleanup", "instance_id", id, "error", err)
+				if saveErr := m.saveMetadata(meta); saveErr != nil {
+					log.ErrorContext(ctx, "failed to retain vGPU assignment metadata after cleanup failure", "instance_id", id, "error", saveErr)
+				}
 			}
 		})
 		if err := m.saveMetadata(meta); err != nil {

lib/instances/vgpu.go

@@ -67,7 +67,7 @@ func (m *manager) vgpuAssignmentClaimedByLiveInstance(ctx context.Context, exclu
 		if inst.Id == excludeID || inst.GPUDevicePath != devicePath || inst.HypervisorPID == nil {
 			continue
 		}
-		if ProcessExists(*inst.HypervisorPID) {
+		if HypervisorProcessExists(*inst.HypervisorPID, inst.SocketPath) {
 			return true, nil
 		}
 	}