This seems fine to me (and the generally correct way to handle size_t and ssize_t comparisons) but I'd like to see what @asomers thinks.

I note that bufsize and size2 cannot be negative, and fuse_read_in::size is uint32_t so maybe there's an opportunity to change (some) types and avoid (some) casts?

The real tension is between in.body.read.size being unsigned and read() returning signed. We could change size1 and size2 to unsigned numbers, but then we'd have to cast them when checking the output of read, as is done on line 1521. I don't have a strong preference for which, but I think you can remove the "size1 >= 0" check. We can't change the type of fuse_read_in::size, because that's part of the FUSE API.