For debugging, I've used "chattr +i" in the past in order to make such files (i.e. /etc/shadow) immutable. This would hopefully expose the mutator (other than Guix)--it should log some error somewhere.
pgpKrPhEw9hmR.pgp
Description: OpenPGP digital signature
