POSIX.1-2008 specifies an open(2) flag O_SEARCH which is specified in one sentence
Open directory for search only.
plus more verbiage scattered over the definition of all the file-access system calls.
The Linux kernel does not provide this flag; instead it has O_PATH, which the manpage describes thus:
Obtain a file descriptor that can be used for two purposes: to indicate a location in the filesystem tree and to perform operations that act purely at the file descriptor level. [488 more words follow]
It appears to me, based on skimming the scattered POSIX verbiage, that O_PATH applied to a directory is more or less equivalent to O_SEARCH. (O_PATH can also be applied to other types of file but that's not what interests me right now.) However, "more or less" could be hiding any number of nasty gotchas.
So: I'm looking for a detailed and comprehensive list of differences between the actually-implemented semantics of O_PATH applied to a directory, and the specified semantics of O_SEARCH. To put it another way, what are all the cases where
#define O_SEARCH (O_PATH|O_DIRECTORY)
fails to provide the expected semantics of O_SEARCH?