Declaring stdout as stder

TL;DR

• Redirections are read sequentially left-to-right
• after redirections are read, file descriptors no longer point to what they were before.

Answer

The core reason why is because 1 no longer refers to stdout when 2>&1 is read, but to hold file, since redirections are processed left to right.

First of all, remember that all commands within Unix environment have standard streams, which are referenced via file descriptors 0 for stdin, 1 for stdout, and 2 for stderr. There are of course rare exceptions, but 99% of times this is the standard file descriptors.

Redirections such as m>n, m>&1 and m<n perform syscall dup2() which makes copies of file descriptors ( aka file handles). In m>n, m is typically a file descriptor, and n can be either a file or another file descriptor. That's exactly what 2>&1 are - integer references to file descriptors corresponding to stdin and stdout.

When cat x y 1> hold 2>&1 occurs, shell first will open hold file, and reference it via next available file descriptor, typically 3, and then perform copy of that file descriptor via dup2(3,1). dup2() syscall is kinda like cp command, where you have cp old copy. Thus, now file descriptor 1 refers to the same open file description (aka struct file in Linux kernel) independently of the other file descriptor 3.

When 2>&1 is seen, shell performs second dup2(1,2). So now file descriptor 2 is an independent copy of file descriptor 1, but what was it before 2>&1 was seen ? 1 was already pointing to the open file hold. From there shell will perform fork and execve syscall to actually run cat as subprocess, which will inherit open file descriptors.

But as far as commands are concerned, in this case cat, it writes to file descriptors 1 and 2 without being aware they are copies of something else.

You can see all of that in action with strace command:

# ... is several irrelevant lines skipped of bash opening libraries 
$ strace -f -edup2,openat,write bash -c 'cat testFile.txt > hold 2>&1'
...
strace: Process 17766 attached
[pid 17766] openat(AT_FDCWD, "hold", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 3
[pid 17766] dup2(3, 1)                  = 1
[pid 17766] dup2(1, 2)                  = 2
[pid 17766] openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
[pid 17766] openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
[pid 17766] openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
[pid 17766] openat(AT_FDCWD, "testFile.txt", O_RDONLY) = 3
[pid 17766] write(1, "potato\n\nNAME   MAJ:MIN RM   SIZE"..., 248) = 248
[pid 17766] +++ exited with 0 +++

Side note:

If the original intention is to let stderr show up on screen, then 2>&1 can be removed from the command. cat x y > hold is sufficient to send stdout to hold file and stderr to screen.

If the intend is to send stderr via stdin to a pipe, we will need to swap file descriptors

$ cat x y 3>&2 2>&1 2>&3 2>hold | grep --color=always file
this is a test file y
$ cat hold
cat: x: No such file or directory

This basically performs a swap like so:

# 3>&2 open new fd 3 , save copy of fd 2 there
dup2(2, 3)                              = 3
# 2>&1 , now turn 2 into copy of 1; 2 is still safe as fd 3
dup2(1, 2)                              = 2
# 2>&3 Now let's make 2 refer to what originally was 1, but now saved in 3
dup2(3, 2)                              = 2
# open file "hold" , which will be next available integer fd
openat(AT_FDCWD, "hold", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
# 2>hold
dup2(4, 2)                              = 2