anchor.diff:        for BIN in ${pkgs.busybox}/{s,}bin/*; do
           copy_bin_and_libs $BIN
         done
  +
  +      ${optionalString zfsRequiresMountHelper ''
  +        # Filesystems using the "zfsutil" option are mounted regardless of the
  +        # mount.zfs(8) helper, but it is required to ensure that ZFS properties
  +        # are used as mount options.
  +        #
  +        # BusyBox does not use the ZFS helper in the first place.
  +        # util-linux searches /sbin/ as last path for helpers (stage-1-init.sh
  +        # must symlink it to the store PATH).
  +        # Without helper program, both `mount`s silently fails back to internal
  +        # code, using default options and effectively ignore security relevant
  +        # ZFS properties such as `setuid=off` and `exec=off` (unless manually
  +        # duplicated in `fileSystems.*.options`, defeating "zfsutil"'s purpose).
  +        copy_bin_and_libs ${pkgs.util-linux}/bin/mount
  +        copy_bin_and_libs ${pkgs.zfs}/bin/mount.zfs
  +      ''}
   
         # Copy some util-linux stuff.
         copy_bin_and_libs ${pkgs.util-linux}/sbin/blkid
  
positive.code:       echo "testing patched programs..."
        $out/bin/ash -c 'echo hello world' | grep "hello world"
        export LD_LIBRARY_PATH=$out/lib
        $out/bin/mount --help 2>&1 | grep -q "BusyBox"
        $out/bin/blkid -V 2>&1 | grep -q 'libblkid'
        $out/bin/udevadm --version
        $out/bin/dmsetup --version 2>&1 | tee -a log | grep -q "version:"
  
negative.code:   # booting (such as the FS containing `/nix/store`, or an FS needed for
    # mounting `/`, like `/` on a loopback).
    fileSystems = filter utils.fsNeededForBoot config.system.build.fileSystems;
  
    # Determine whether zfs-mount(8) is needed.
    zfsRequiresMountHelper = any (fs: lib.elem "zfsutil" fs.options) fileSystems;
  
    # A utility for enumerating the shared-library dependencies of a program
    findLibs = pkgs.buildPackages.writeShellScriptBin "find-libs" ''
  