Thank you very much!

Of course, I have studied the docs before asking here, and have read the relevant portions of perlvar. The leading E and U and G were clear so far :-)

However, the problem is that perlvar does not state how an assignment to these variables is implemented behind the scenes. At the API level, there is a myriad of functions that could be used, some of them only altering EUID / EGID, some of them (potentially) altering UID / GID at the same time, some of them exchanging EUID vs UID, and so on. perlvar also tells that it uses a syscall to implement the assignments, but does not tell which syscall that is.

Also, despite intensive tests, I have never encountered a situation where $UID / $GID were different from $orig_UID / $orig_GID at line 7, so I don't understand the sense of this assignment and how it drops privileges.