Constant LOCK_DROP 

pub const LOCK_DROP: lock_state_t = 2;

The sandbox lock is in drop-only mode, allowing only privilege-dropping sandbox commands.