Hm.
in read_chan I see
else if (current->pgrp != tty->pgrp) {
if (is_ignored(SIGTTIN) ||
is_orphaned_pgrp(current->pgrp))
return -EIO;
kill_pg(current->pgrp, SIGTTIN, 1);
return -ERESTARTSYS;
}
I wonder if SIGTTIN is ignored. This check of course bypasses the thing you patched.