OnAccessIncludePath recursive folder watch bug

Describe the bug

ClamAV 1.5.3 on Linux 7.1.8 with DDD enabled.

Directories existing before clamonacc startup receive only the root fanotify mark, so RTP and on access scans don't work unless the file is located in the folder root; descendant directories are not recursively marked. Directories created after clamonacc startup are dynamically marked correctly. fdinfo confirms missing descendant marks. inotify limits are 524288 watches / 1024 instances, with no ENOSPC errors reported in the logs. Reproduced correctly on /opt. /run, /home and newly created file system folders.

How to reproduce the problem

• Set one or more directory paths to be watched in the config file via the OnAccessIncludePath directories
• Restart ClamAV and related components
• Copy/download/create a file with the EICAR test signature in any of the watched folders' children

Copying the file to the folder's root successfully triggers a quarantine event.

Attachments

Configuration file (only modified or explicitly set properties):

LogFile /var/log/clamav/clamd.log
LogTime yes
ExtendedDetectionInfo yes
PidFile /run/clamav/clamd.pid
TemporaryDirectory /tmp
LocalSocket /run/clamav/clamd.ctl
LocalSocket /run/clamav/clamd.ctl
MaxDirectoryRecursion 20

User clamav
DetectPUA yes
HeuristicAlerts yes
AlertBrokenExecutables yes
AlertBrokenMedia yes
AlertEncrypted yes
AlertEncryptedArchive yes
AlertEncryptedDoc yes
AlertOLE2Macros yes
AlertPartitionIntersection yes
ScanPE yes
ScanELF yes
ScanOLE2 yes
ScanPDF yes
ScanSWF yes
ScanXMLDOCS yes
ScanHWP3 yes
ScanOneNote yes
ScanMail yes
ScanArchive yes
OnAccessDisableDDD no
OnAccessIncludePath /home
OnAccessIncludePath /opt
OnAccessIncludePath /run
OnAccessPrevention yes
OnAccessExtraScanning yes
OnAccessExcludeUname clamav
OnAccessRetryAttempts 3
Bytecode yes

If applicable, add screenshots to help explain your problem.

If the issue is reproducible only when scanning a specific file, attach it to the ticket.