This is a really interesting example of why implicit "zero values" for structs in go can be a problem: https://github.com/ubuntu/authd/security/advisories/GHSA-g8qw-mgjx-rwjr
"The temporary user record we returned in the pre-auth NSS request did
not have a GID set, so it defaulted to GID 0 (the ID of the root group)."
I suppose one could argue that it's more of an issue in posix that a uid or gid value of 0 was not defined as nobody/nogroup but root.