Verify pull path in do_stat itself to fix security issue in VD.