xattr: switch to CLASS(fd) (CVE-2024-14027) | HOL Guard CVE