As far as I understand it: A background subshell is started that waits 10 seconds and then runs a program with the input "id". That program uses ioctl to send

As far as I understand it: A background subshell is started that waits 10 seconds and then runs a program with the input "id". That program uses ioctl to send characters to the current TTY. Since the user exited back to the root shell before the program executed, the `id` command is typed and executed on the root shell.