Re: [PATCH 0/2] MR6777: ntdll: Add SIGSYS handler to support syscall emulation on macOS Sonoma and later.

[Aida Jonikienė (＠DodoGTA)]

On Wed Nov  6 06:30:04 2024 +0000, Brendan Shanks wrote:
> Linux and Wine syscall numbers both start at 0, so seccomp or syscall
> user dispatch is required to differentiate whether PE or ELF code is
> calling a syscall.
> macOS syscall numbers don't start at 0, they [have a
> "class"](https://stackoverflow.com/questions/48845697/macos-64-bit-system-call-table)
> in the top 24 bits: they start at 0x2000000 and increment from there. 
> On macOS syscall numbers starting at 0 are invalid, so calling them
> triggers SIGSYS.

So that's another lucky thing that macOS has (first it was that arbitrary memory mapping for OpenGL WoW64 support and now it's this behavior)