[rleigh]

Any project can contain fatal flaws irrespective of its review policies. Particularly when we are concerned with the subtle behaviour of the interaction between write and fsync. Even if you read the standard it's not clear exactly how the system as a whole should behave; there are a number of situations which aren't mentioned in the standard at all.

It would be quite possible for a review, and even extensive testing, to fail to pick up on some system-specific subtleties.