visudo -c can return “parsed OK” for a rule that authorizes more than its reviewer intended. That is not a parser defect. Syntax validation answers whether sudo can read the policy; it does not prove that the allowed command, argument string, executable bytes, run-as identity and recovery ...