Pretty poorly. We emulate git's behavior which is to try, in order:

1. Test if the entry exactly matches the file path
2. Test if the entry matches the file path using `fnmatch(3)`
3. If there are no wildcard matches, test if the entry matches a directory name prefix of the file path

Then after we check if the match was made, we flip the decision to include the file if the pattern was prefixed with a `!` or a `^`.

Additionally, there is a diff flag `GIT_DIFF_DISABLE_PATHSPEC_MATCH` which turns off this behavior and just treats each entry as an exact match only.

Since case 1 is evaluated first, you generally don't have to escape filenames even if they include pattern characters, although there are certainly cases where it gets confusing or problematic.