The kernel on Apple Silicon enforces a default 4GB page zero for executables and rejects smaller ones at exec time, so the loader is built as a standard PIE executable instead of a dlopen-style image (no fixed load address, following the OS ASLR policy). The Windows shared user data and TEB blocks cannot live at their usual fixed low addresses, so they are allocated at OS-chosen addresses and the PE side fetches the shared user data address through a new unix call. The PE image section protections are applied in two passes so that, on hosts with a 16KB page size, an executable page is never also writable (macOS W^X enforcement). Finally, the ARM64 syscall dispatcher returns into PE code with br instead of ret, since ret x16/x17 on arm64e clears the x18 TEB register, which crashed the first PE execution with a NULL TEB. ntdll: Make the ARM64 syscall path and TEB access reliable on Apple Silicon. The syscall and unix call dispatchers relied on the x18 register holding the TEB when entered from PE code, but on Apple Silicon x18 is cleared when the CPU first executes a fresh code page, and TPIDR_EL0 is reset by macOS on signal delivery. Both could fault or dispatch a syscall to the wrong thread's frame. The dispatchers now find the current thread's syscall frame through the pthread thread data, which is reliable, and save the full context there. The context save previously clobbered x19 (it held the user stack pointer for the argument marshalling but was also written to the frame), which corrupted heap operations in the caller. The PE-side NtCurrentTeb is now a real ntdll export instead of an inline x18 read. It uses the per-thread TPIDR_EL0 value when valid, otherwise it validates the cached TEB against the current stack pointer and falls back to a unix call to get the current thread's TEB from the pthread data. Finally, loader_init now always refreshes the shared user data address and the TEB on Apple Silicon, fixing the unmapped 0x7ffe0000 dereferences. ntdll: Fix the unix call dispatcher and syscall return on Apple Silicon. The unix call dispatcher found its syscall frame through the racy cached TEB, which could select another thread's frame when TPIDR_EL0 was reset; it now uses the same pthread-data based helper as the syscall dispatcher. The syscall return stub reloaded the TEB from the saved frame, but a nested syscall performed by the service handler overwrites frame->x18 with its own value, so the stub now reads the current TEB directly. With these fixes wineboot completes the prefix initialization. -- v4: [win32u] nothing should be before config.h https://gitlab.winehq.org/wine/wine/-/merge_requests/11638