Alexander - I quoted just the most relevant lines of code. The link I posted to the failing test report shows it failing. As I meant to imply, the test t/a1.t in that module is the Short, Self-Contained, Correct Example of the problem, the other test files add monkey patches to try to diagnose where the taint happens. Like you, I cannot reproduce the error myself, it only happens on certain CPAN test machines and not on any attempt I've made to create a VM with the same OS and perl versions. As I said, my tests run with ./log already existing in the environment. When ./log exists, correct behavior is no error. Without ./log correct behavior is the directory does not exist error. My test module has the log directory in the MANIFEST so that the only failures on CPAN are due to the bug. I think I understand what taint mode does. The monkey patched test in t/a4.t shows that untainted data is being passed to File::Spec::Unix->canonpath whose source code does not make use of any external data, and the return value from that function call is tainted. When I try to monkeypatch canonpath the error does not happen even on the relevant CPAN test machines. It's a heisenbug. Hence the mystery I am asking about.