> The program could read this -1 to (for example) uint16_t and interpret as 65535 and fail to notice the parent is not giving any fd.
File descriptors have been of int type since Unix was designed (at least) and -1 is documented as the invalid descriptor. E.g. the open() system call and every other system call returning an fd returns -1 on error and always has. The idea that any program would read something explicitly documented as a file descriptor into an unsigned type seems effectively inconceivable.
David