Re: [PATCH 0/2] MR6777: ntdll: Add SIGSYS handler to support syscall emulation on macOS Sonoma and later.

[Brendan Shanks (＠bshanks)]

On Wed Nov  6 01:19:35 2024 +0000, Aida Jonikienė wrote:
> How does macOS support this without the need for seccomp or syscall user
> dispatch (like on Linux)?

Linux and Wine syscall numbers both start at 0, so seccomp or syscall user dispatch is required to differentiate whether PE or ELF code is calling a syscall.

macOS syscall numbers don't start at 0, they [have a "class"](https://stackoverflow.com/questions/48845697/macos-64-bit-system-call-table) in the top 24 bits: they start at 0x2000000 and increment from there.

On macOS syscall numbers starting at 0 are invalid, so calling them triggers SIGSYS.