Fixed dd /dev/zero truncation in packages/bare-os-coreutils/src/dd.js

if=/dev/zero with finite count*bs now produces requested size directly (not limited by VFS 64KiB pseudo-file).
Raw stdout now uses bareOsEmitRaw, improving pipeline correctness.
Fixed pipeline capture path for FIFO-relevant commands

echo and cat now emit via bareOsEmitRaw (packages/bare-os-coreutils/src/echo.js, packages/bare-os-coreutils/src/cat.js).
Shell pipeline now injects bareOsBinWrite into child contexts when output is captured, so raw writes are captured (packages/bare-os-booter/lib/shell.js).
Improved xattr behavior in packages/bare-os-coreutils/src/xattr.js

Added -p/--print NAME.
-w now logs written attribute name for visible success feedback.
Roundtrip behaviors preserved with sidecar metadata format.
Improved ACL UX in:

packages/bare-os-coreutils/src/getfacl.js
Explicit source header for sidecar and mode fallback (non-compact mode).
packages/bare-os-coreutils/src/setfacl.js
Added -m/--modify ENTRY in addition to stdin blob and -b.
Implemented dynamic ulimit output in packages/bare-os-coreutils/src/ulimit.js

Reads /proc/bare_os/rlimits.json when available.
Supports -a, -n, -Sn, -Hn.
Added shuf -e support in packages/bare-os-coreutils/src/shuf.js.

Added split byte-suffix parsing (k/K/m/M/g/G) and attached -bSIZE support in packages/bare-os-coreutils/src/split.js.

kernel/bin/setfacl

@@ -95,6 +95,8 @@ function bareOsEmitRaw(ctx, chunk) {
 async function run(ctx, argv) {
   let clear = false
   /** @type {string[]} */
+  const modify = []
+  /** @type {string[]} */
   const files = []
   for (let i = 1; i < argv.length; i++) {
     const a = argv[i]
@@ -102,9 +104,20 @@ async function run(ctx, argv) {
       clear = true
       continue
     }
+    if (a === '-m' || a === '--modify') {
+      const spec = argv[i + 1]
+      if (!spec) {
+        ctx.console.error('setfacl: -m requires ACL entry')
+        ctx.exitCode = 1
+        return
+      }
+      modify.push(spec)
+      i++
+      continue
+    }
     if (a === '--help' || a === '-h') {
       ctx.console.log(
-        'usage: setfacl [-b] PATH\nWrites ACL text from stdin when not clearing.'
+        'usage: setfacl [-b] [-m ENTRY] PATH\nWrites ACL text from stdin when not clearing.'
       )
       return
     }
@@ -137,14 +150,43 @@ async function run(ctx, argv) {
       }
       return
     }
-    const text = bareStdin(ctx)
-    if (!text || !String(text).trim()) {
-      ctx.console.error('setfacl: ACL text required on stdin')
-      ctx.exitCode = 1
-      return
+    let body = ''
+    if (modify.length) {
+      const prev = await ctx.vfs.readFile(side)
+      const lines = prev
+        ? ctx.b4a
+            .toString(prev)
+            .split(/\r?\n/)
+            .map((x) => x.trim())
+            .filter(Boolean)
+        : []
+      const byKey = new Map()
+      for (const ln of lines) {
+        const k = ln.split(':', 2).join(':')
+        byKey.set(k, ln)
+      }
+      for (const m of modify) {
+        const spec = String(m).trim()
+        if (!spec.includes(':')) {
+          ctx.console.error('setfacl: invalid ACL entry ' + spec)
+          ctx.exitCode = 1
+          return
+        }
+        const key = spec.split(':', 2).join(':')
+        byKey.set(key, spec)
+      }
+      body = [...byKey.values()].join('\n')
+    } else {
+      const text = bareStdin(ctx)
+      if (!text || !String(text).trim()) {
+        ctx.console.error('setfacl: ACL text required on stdin')
+        ctx.exitCode = 1
+        return
+      }
+      body = String(text)
     }
-    const body = String(text).endsWith('\n') ? String(text) : String(text) + '\n'
-    await ctx.vfs.writeFile(side, ctx.b4a.from(body))
+    const finalBody = body.endsWith('\n') ? body : body + '\n'
+    await ctx.vfs.writeFile(side, ctx.b4a.from(finalBody))
   } catch (e) {
     ctx.console.error('setfacl: ' + (e && e.message ? e.message : String(e)))
     ctx.exitCode = 1