(note: /path/to/image is not a device path) complains

Given that the header can be dumped without being root, it seems true that one should be able to test the passphrase without being root, as long as you can access the header/image.

I can see in lib/device_utils.c`device_internal_prepare that indeed, cryptsetup makes this check proactively rather than just failing somewhere else. In the case of --test-passphrase, is this really needed?

I don't think that is the code path for --test-passphrase though, since --test-passphrase doesn't require a device path whereas the referenced code does seem to require it. I didn't search exhaustively for that error message, just stopped at the first place where it seems superfluous. Couldn't a process have a mount capability without being uid 0?