Doh - slow brain day - thanks for the correction. That nullifies my concern when user is not root, for part of the rename() issue.
I think the return values of rename() should be checked, and it history_do_write() should not try to rename(bakname, output) unless it actually did rename(output, bakname) successfully. And with both rename() calls, ERRNO should be reported to the user if they fail.
As far as open() on HISTFILE for append or truncate, when user is root (or when user has owner or group write to the file), I think bash (readline?) shouldn't overwrite, append to or rename non-regular files.
I also think the handling of the case where HISTFILE is a symlink may misbehave (it would read the history in from the file the link refers to, but on overwrite, replace the symlink, instead of the file it refers to.)