Bug#867997: jessie->stretch, all apt clients break with /var/lib/dpkg/status realpath error

>Sorry to hear you had issues with the upgrade.
>
>The problem you describe appears to be related to the release notes item
>[5.3.2] (5.3.2.1 actually, but I cannot find the direct link to that).
>The exact case with /var/lib/dpkg/status is not mentioned, but it could
>be that there are some permissions on your system that forbit "_apt" to
>access /var/lib/dpkg/status.
>
> * Could you please try to login in as the _apt user and check that it
>   can read /var/lib/dpkg/status?

Due to the /nonexistent home directory and /bin/false login shell,
it does not appear to be possible to log in as _apt:

# su - _apt
No directory, logging in with HOME=/

If I change _apt's HOME to /tmp and login shell to /bin/bash:

# su - _apt
_apt$ apt-get check
E: Could not open lock file /var/lib/dpkg/lock - open (13: Permission denied)
E: Unable to lock the administration directory (/var/lib/dpkg/), are you root?

>   - If it fails, please attempt to figure out where the permission
>     fails (e.g. [dir-test])

# ls -ld / /var /var/lib /var/lib/dpkg /var/lib/dpkg/status
drwxr-xr-x 21 root root    1024 Jul 10 11:21 /
drwxr-xr-x 13 root root    4096 May  7  2013 /var
drwxr-xr-x 74 root root    4096 Jul  7 16:01 /var/lib
drwxr-xr-x  8 root root    4096 Jul 11 08:48 /var/lib/dpkg
-rw-r--r--  1 root root 1961225 Jul 11 08:48 /var/lib/dpkg/status

As you can see, none of these are writable by _apt; however, 
these are the same permissions I see on the other (working)
Debian 9 system. lsattr shows no attributes on any /var/lib/dpkg/status
files.

>
> * If you have any policy framework enabled (SELinux or AppArmor),
>   please check if any of these are forbidding the access.

Neither of those are enabled.