Issue with open syscall in /tmp folder with uid 0

Question

I have conducted a small test which raised an issue i could not figure out.

1. Create file in /tmp named what as shell user (uid 1000), then make it 0666 (rw-rw-rw-)
2. Try to call open with uid 0 (root) in the following format: open("/tmp/what", O_WRONLY | O_CREAT, 0666);

And for my surprise, the syscall failed with errno "Permission denied", although i'm running as root.

So i tried to do the exact opposite, create the file as root, then chmod it to 0666, and try to call open the same way but with uid 1000, and for some reason it WORKED.

I tried to re-create the issue in other directories but found no success, meaning it had something to do with /tmp

But the more interesting thing was that if i were to remove the O_CREAT flag it resolves the issue, although i have no idea why since this flag is considered if and only if the file does not exist, I'm quite sure i'm missing something...

Would love for some assistance.