I don't think this holds if we can guarantee capacity ≥ 3:
You're right, in fact we can see straightforwardly that
```math \newcommand{\OP}{\mathsf{OldPages}} \newcommand{\Ps}{\mathsf{PageSize}} \newcommand{\Hs}{\mathsf{HeadSize}} \newcommand{\Es}{\mathsf{EltSize}} \[1ex] \begin{align*} 1&> k\ &> \frac23\cdot\frac\Ps\Es + \frac13\cdot\frac{\OP\cdot\Ps - \Hs}\Es\[2ex] &> \frac13\cdot\frac{\OP\cdot\Ps - \Hs}\Es\ &\geq \frac13\cdot\left(\text{\textsf{old capacity}}\right) \end{align*} ```
doesn't hold for (old capacity) ≥ 3, but that doesn't hold for 3⋅EltSize ≤ 2⋅PageSize either (which is currently the case).
I'm not saying this code is incorrect, but that this function in isolation could (and arguably should) guard against otherwise benign future patches, such as element size extension or initial capacity adjustment.
I don't see what you mean by that, where is this guarded exactly?
In https://gitlab.winehq.org/wine/wine/-/blob/552cc456d1889ab3ee0dd5ead6c7520c34d030c0/server/fd.c#L2692 and https://gitlab.winehq.org/wine/wine/-/blob/552cc456d1889ab3ee0dd5ead6c7520c34d030c0/server/mapping.c#L1028, others being not a problem a priori due to working on a new empty temporary file.