Review follow-up: the comment in _bash_starts now says why stdin=DEVNULL matters beyond the bounded cleanup — cygwin init's handle_to_fn/NtQueryObject stalls on a pipe file object that has a read pending (the ACP host's stdin), which is why the probe blew its timeout inside ACP hosts — and why stderr stays captured (the Mandatory-ASLR remediation keys off bash's dofork:/child_copy: text).