Please note that it by default appears on Bullseye only. See that last
mails regarding this issue, the related changed sysfs setting has
identified already do:
-------
sysctl fs.protected_regular=2
-------
and retry the steps, which will then fail.
-------
sysctl fs.protected_regular=0
-------
to revert to default until up to Buster. From Bullseye on that defaults
to "2" which prevents any user from write + "O_CREAT" to a file within a
world-writeable + sticky bit directory (1777) that is owned by another user.
Best regards,
Micha