kit

link.c (102226B)

---

 /* link_emit_macho — write a dyld-loadable arm64 MH_EXECUTE.
  *
  * Mach-O peer of link_emit_elf.  Produces a position-independent
  * MH_EXECUTE that links against libSystem.B.dylib (or any other
  * dylib/.tbd input) via LC_LOAD_DYLIB + LC_DYLD_CHAINED_FIXUPS.  The
  * binary is ad-hoc codesigned at the tail so the kernel will exec it
  * on macOS 11+.
  *
  * Layout (Apple's stock arm64 layout):
  *
  *   __PAGEZERO  vmaddr 0, vmsize 0x100000000, no file bytes
  *   __TEXT  (R-X)
  *     mach_header_64
  *     load commands
  *     [SF_EXEC sections — .text]
  *     [SF_ALLOC R-only sections — .rodata, init/fini_array, etc.]
  *     __stubs (12B per import-func)
  *   __DATA_CONST  (RW initially, dyld marks R-only after fixups)
  *     __got    (8B per import — both data and func imports)
  *   __DATA  (R-W)
  *     [SF_WRITE sections — .data, .bss]
  *   __LINKEDIT  (R)
  *     dyld_chained_fixups blob
  *     dyld_exports_trie blob
  *     function starts (empty)
  *     data in code (empty)
  *     symtab
  *     indirect symbol table (one entry per __stubs and __got slot)
  *     strtab
  *     code signature
  *
  * Imports are routed:
  *   CALL26/JUMP26 against an imported function -> __stubs entry
  *   GOT_LOAD_PAGE21/PAGEOFF12 against any import -> __got slot
  *   ABS64 against an imported symbol            -> chained-bind at site
  *   ABS64 against a defined internal symbol     -> chained-rebase at site
  *
  * arm64-only.  x86_64-macos arrives with x64 codegen. */
 
 #include "link/link.h"
 
 #include <string.h>
 
 #include "core/bytes.h"
 #include "core/heap.h"
 #include "core/pool.h"
 #include "core/sha256.h"
 #include "core/slice.h"
 #include "core/util.h"
 #include "core/vec.h"
 #include "link/link_arch.h"
 #include "link/link_internal.h"
 #include "link/link_reloc_desc.h"
 #include "obj/bytebuf.h"
 #include "obj/format.h"
 #include "obj/macho/macho.h"
 
 /* ---- constants ---- */
 #define MZ_PAGEZERO 0x100000000ULL
 #define MZ_PAGE 0x4000ULL
 #define MZ_GOT_SIZE 8u
 /* __DATA,__thread_ptrs slot size — one pointer per unique TLV referenced
  * via TLVP_LOAD_PAGE21/PAGEOFF12. Each slot holds the address of the
  * matching TLV descriptor in __DATA,__thread_vars. */
 #define MZ_TLVP_SIZE 8u
 
 #define DYLD_CHAINED_PTR_64 2u
 #define DYLD_CHAINED_IMPORT 1u
 
 #define VM_PROT_READ 0x1u
 #define VM_PROT_WRITE 0x2u
 #define VM_PROT_EXECUTE 0x4u
 
 #define CS_MAGIC_EMBEDDED_SIGNATURE 0xfade0cc0u
 #define CS_MAGIC_CODEDIRECTORY 0xfade0c02u
 #define CSSLOT_CODEDIRECTORY 0u
 #define CS_HASHTYPE_SHA256 2u
 #define CS_SHA256_LEN SHA256_DIGEST_LEN
 /* Default code-signing hash page size (log2). Apple's tools sign with a page
  * size that matches the target's native VM page: 4 KiB (12) on x86_64, but
  * 16 KiB (14) on Apple-Silicon arm64. The kernel's loader validates the main
  * executable against its own (16 KiB) pages, so a 4 KiB-page signature is
  * rejected as invalid on arm64 once the image is large enough to span the
  * mismatch — small images can slip through, large ones SIGKILL with "invalid
  * signature". MCtx.cs_page_log2 carries the per-target choice; this is the
  * x86_64 fallback. */
 #define CS_PAGE_SIZE_LOG2 12u
 #define CS_EXECSEG_MAIN_BINARY 1u
 
 /* extra LC ids */
 #define LC_DYLD_INFO_ONLY (0x22u | 0x80000000u)
 #define LC_FUNCTION_STARTS_C 0x26u
 #define LC_DATA_IN_CODE_C 0x29u
 #define LC_CODE_SIGNATURE_C 0x1du
 
 /* ---- byte buffer ----
  * Linkedit tables / load commands / the output file are staged in the shared
  * ObjByteBuf (objbb_*). */
 
 /* ---- imports + dylibs ---- */
 
 typedef struct MachImp {
   LinkSymId sym;
   Sym name;
   u32 dylib_ord;    /* 1-based ordinal into LC_LOAD_DYLIB list */
   u32 stub_idx;     /* 1-based index into __stubs (0 if data import) */
   u32 got_idx;      /* 1-based index into __got */
   u32 imports_strx; /* offset into chained-fixups symbol pool */
   u8 is_func;
   u8 weak;
   /* internal=1 means this entry is an in-image symbol that's referenced
    * via GOT_LOAD_PAGE21 / LD64_GOT_LO12_NC (clang emits these for any
    * extern global so a single static-link can later become PIC).  The
    * GOT slot stores the symbol's image-relative vaddr and gets a
    * chained-fixup rebase entry (or no entry at all for a weak-undef
    * resolving to NULL).  No dylib_ord / stub_idx / chained-fixup bind. */
   u8 internal;
 } MachImp;
 
 typedef struct MachDylib {
   Sym install;
 } MachDylib;
 
 /* One slot in the synthetic __DATA,__thread_ptrs section per unique TLV
  * descriptor referenced via TLVP_LOAD_PAGE21/PAGEOFF12.  Modeled after
  * MachImp's internal-GOT entries: the slot holds the descriptor address
  * (REBASE for internal-to-image descriptors, BIND for dylib-imported
  * ones).  The descriptor itself is laid out in __DATA,__thread_vars by
  * either the input objects (internal) or the providing dylib (imported). */
 typedef struct MachTlv {
   LinkSymId sym; /* canonical descriptor LinkSymId */
   u32 tlv_idx;   /* 1-based slot index in __thread_ptrs */
   u8 imported;   /* 1 == descriptor lives in a dylib (BIND), 0 == internal
                     (REBASE) */
   u8 pad[3];
   u32 import_idx; /* 1-based MachImp index when imported (for chained-bind
                      ordinal) */
 } MachTlv;
 
 /* ---- planned section ---- */
 
 typedef struct MSec {
   /* Source: either a LinkSection (link_sec_id != 0) or a synthetic
    * pre-built byte buffer (data + size). */
   LinkSectionId link_sec_id;
   const u8* synth_data;
   u32 synth_size;
   /* Mach-O placement */
   const char* segname;
   const char* sectname;
   /* Inline storage for segname/sectname when split from a Mach-O
    * `__SEG,__sect`-form LinkSection name.  Names from string literals
    * (synth sections, derived-from-flags defaults) point at .rodata
    * and don't use these.  17 bytes: the on-disk field is a fixed 16
    * (no NUL needed there), but these are read as C strings, so a full
    * 16-char name (e.g. __debug_line_str) needs the extra NUL slot. */
   char segname_buf[17];
   char sectname_buf[17];
   u64 vaddr;
   u64 file_offset;
   u64 size;
   u32 align;
   u32 flags; /* S_TYPE | S_ATTR_* */
   u32 reserved1;
   u32 reserved2;
   u8 segidx; /* 1=__TEXT, 2=__DATA_CONST, 3=__DATA */
   u8 is_zerofill;
   u8 pad[6];
 } MSec;
 
 static void msec_repair_name_ptrs(MSec* m) {
   if (m->segname_buf[0]) m->segname = m->segname_buf;
   if (m->sectname_buf[0]) m->sectname = m->sectname_buf;
 }
 
 /* Segment slot indices in MCtx.segs[].  __DWARF carries the file-only
  * .debug_* sections (debug-info retention); it sits before __LINKEDIT so
  * the ad-hoc code signature stays the last bytes of the file. */
 enum {
   MSEG_PAGEZERO = 0,
   MSEG_TEXT = 1,
   MSEG_DATA_CONST = 2,
   MSEG_DATA = 3,
   MSEG_DWARF = 4,
   MSEG_LINKEDIT = 5,
   MSEG_COUNT = 6,
 };
 
 typedef struct MSeg {
   const char* name;
   u32 maxprot;
   u32 initprot;
   u64 vmaddr;
   u64 vmsize;
   u64 fileoff;
   u64 filesize;
   u32 nsects;    /* MSec count in segment — internal layout */
   u32 first_sec; /* first index into MSec[] */
   u32 nouts;     /* OutSec count in segment — what hits the file */
   u32 first_out; /* first index into OutSec[] */
 } MSeg;
 
 /* On-disk section view: one record per (segname, sectname) within a
  * segment.  Mach-O requires this — emitting one section_64 per input
  * MSec yields sibling __TEXT,__text records that violate the spec.
  * Built from MSec[] after vaddr placement; reloc-apply still uses
  * MSec[] for byte-buffer addressing. */
 typedef struct OutSec {
   const char* segname;
   const char* sectname;
   u64 vaddr;
   u64 file_offset;
   u64 size;
   u32 align;
   u32 flags;
   u32 reserved1;
   u32 reserved2;
   u8 segidx;
   u8 is_zerofill;
 } OutSec;
 
 /* ---- main context ---- */
 
 typedef struct MCtx {
   LinkImage* img;
   Compiler* c;
   Heap* h;
   Writer* w;
   Linker* linker;
   const LinkArchDesc* link_arch;
   const ObjMachoArchOps* macho;
 
   /* imports */
   MachImp* imports;
   u32 nimports;
   u32 nimports_real; /* count of imports with internal=0 (== prefix length;
                       * collect_imports appends internal=1 entries last) */
   u32 nimport_funcs;
   MachDylib* dylibs;
   u32 ndylibs;
   /* sym->import index, 1-based, 0 = not an import. Sized to LinkSymId space
    * + 1. */
   u32* sym_to_imp;
   u32 sym_to_imp_size;
 
   /* sections + segments */
   MSec* secs;
   u32 nsecs;
   /* link_sec_id (1-based) -> backing MSec, NULL where none. Built once after
    * plan_layout so shift_sections / patch_ptr map a section id to its MSec in
    * O(1) instead of a linear scan of secs per reloc (was O(nrelocs*nsecs)). */
   MSec** by_link_sec;
   u32 by_link_sec_cap; /* img->nsections + 1 */
   OutSec* outs;
   u32 nouts;
   MSeg segs[MSEG_COUNT]; /* PAGEZERO, TEXT, DATA_CONST, DATA, DWARF, LINKEDIT */
   u32 nsegs;
 
   /* Synthetic byte buffers, owned. */
   u8* stubs_bytes;
   u32 stubs_size;
   u8* got_bytes;
   u32 got_size;
   /* TLV pointer slots — one entry in __DATA,__thread_ptrs per unique
    * descriptor referenced via TLVP_LOAD_PAGE21/PAGEOFF12.  sym_to_tlv
    * maps LinkSymId → 1-based slot index (parallel to sym_to_imp).  Slot
    * bytes are populated at apply_relocs time once shift_sections has
    * pinned descriptor vaddrs. */
   MachTlv* tlv_slots;
   u32 ntlv;
   u32* sym_to_tlv;
   u32 sym_to_tlv_size;
   u8* tlv_ptrs_bytes;
   u32 tlv_ptrs_size;
   u64 tlv_ptrs_vaddr;
   /* Vaddr of the first thread-local-storage section
    * (__thread_data / __thread_bss).  Each TLV descriptor's word 2
    * stores the symbol's offset within this image rather than an
    * absolute address — see apply_relocs's S_THREAD_LOCAL_VARIABLES
    * ABS64 special case. */
   u64 tls_image_vaddr;
   u8 has_tls_image;
 
   /* Final layout (computed during plan) */
   u64 text_vaddr;
   u64 stubs_vaddr;
   u64 got_vaddr;
   u64 linkedit_vaddr;
   u64 linkedit_fileoff;
   u32 entry_offset; /* offset of entry within __TEXT segment */
 
   u64 headers_size; /* header + loadcmds */
 
   /* LINKEDIT contents */
   ObjByteBuf chained_fixups;
   ObjByteBuf exports_trie;
   ObjByteBuf symtab; /* binary nlist_64 array */
   ObjByteBuf strtab;
   ObjByteBuf indirect; /* u32 array */
   ObjByteBuf fn_starts;
   ObjByteBuf data_in_code;
   ObjByteBuf codesig;
 
   u32 chained_fixups_off;
   u32 exports_trie_off;
   u32 fn_starts_off;
   u32 data_in_code_off;
   u32 symtab_off;
   u32 indirect_off;
   u32 strtab_off;
   u32 codesig_off;
   u32 codesig_size;
   u8 cs_page_log2; /* code-signing hash page size, log2 (12=4K x64, 14=16K arm64) */
   u32 nsyms;
 
   u8 uuid[16];
 } MCtx;
 
 /* ---- helpers for finding LinkSymbol vaddr ---- */
 
 static LinkSymbol* sym_at(LinkImage* img, LinkSymId id) {
   if (id == LINK_SYM_NONE || id > LinkSyms_count(&img->syms)) return NULL;
   return LinkSyms_at(&img->syms, id - 1);
 }
 
 /* ---- pass: collect imports ---- */
 
 static u32 dylib_ordinal_of(MCtx* x, Sym install) {
   for (u32 j = 0; j < x->ndylibs; ++j)
     if (x->dylibs[j].install == install) return j + 1u;
   return 0;
 }
 
 static void collect_imports(MCtx* x) {
   LinkImage* img = x->img;
   Heap* h = x->h;
 
   x->sym_to_imp_size = LinkSyms_count(&img->syms) + 1u;
   x->sym_to_imp =
       (u32*)h->alloc(h, sizeof(u32) * x->sym_to_imp_size, _Alignof(u32));
   if (!x->sym_to_imp)
     compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on sym_to_imp");
   memset(x->sym_to_imp, 0, sizeof(u32) * x->sym_to_imp_size);
 
   u32 cap = 0, cap_d = 0;
   for (u32 i = 0; i < LinkSyms_count(&img->syms); ++i) {
     LinkSymbol* s = LinkSyms_at(&img->syms, i);
     if (!s->imported) continue;
     if (s->name == 0) continue;
     LinkSymId canon = symhash_get(&img->globals, s->name);
     if (canon != LINK_SYM_NONE && canon != s->id) continue;
     if (VEC_GROW(h, x->imports, cap, x->nimports + 1u))
       compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on imports");
     MachImp* mi = &x->imports[x->nimports++];
     memset(mi, 0, sizeof(*mi));
     mi->sym = s->id;
     mi->name = s->name;
     mi->is_func = (s->kind == SK_FUNC || s->kind == SK_IFUNC) ? 1 : 0;
     mi->weak = (s->bind == SB_WEAK) ? 1 : 0;
     x->sym_to_imp[s->id] = x->nimports;
   }
 
   /* Back-classify: any CALL26/JUMP26 reloc target -> function. */
   for (u32 i = 0; i < LinkRelocs_count(&img->relocs); ++i) {
     LinkRelocApply* r = LinkRelocs_at(&img->relocs, i);
     if (!reloc_kind_is_branch(x->c, r->kind)) continue;
     if (r->target == LINK_SYM_NONE || r->target >= x->sym_to_imp_size) continue;
     u32 idx = x->sym_to_imp[r->target];
     if (!idx) {
       /* Resolve through canonical. */
       LinkSymbol* tgt = LinkSyms_at(&img->syms, r->target - 1);
       if (tgt->name == 0) continue;
       LinkSymId canon = symhash_get(&img->globals, tgt->name);
       if (canon == LINK_SYM_NONE || canon >= x->sym_to_imp_size) continue;
       idx = x->sym_to_imp[canon];
       if (!idx) continue;
       /* Stash so future lookups skip this loop. */
       x->sym_to_imp[r->target] = idx;
     }
     x->imports[idx - 1].is_func = 1;
   }
 
   /* Build dylib ordinal table.  Pull soname from the providing DSO. */
   for (u32 i = 0; i < x->nimports; ++i) {
     MachImp* mi = &x->imports[i];
     LinkSymbol* s = sym_at(img, mi->sym);
     LinkInputId dso_id = s ? s->dso_input_id : LINK_INPUT_NONE;
     Sym install = 0;
     if (dso_id != LINK_INPUT_NONE && x->linker &&
         dso_id - 1u < LinkInputs_count(&x->linker->inputs)) {
       LinkInput* in = LinkInputs_at(&x->linker->inputs, dso_id - 1u);
       if (in->kind == LINK_INPUT_DSO_BYTES) install = in->soname;
     }
     if (install == 0)
       install = pool_intern_slice(x->c->global,
                                   SLICE_LIT("/usr/lib/libSystem.B.dylib"));
     u32 ord = dylib_ordinal_of(x, install);
     if (!ord) {
       if (VEC_GROW(h, x->dylibs, cap_d, x->ndylibs + 1u))
         compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on dylibs");
       x->dylibs[x->ndylibs].install = install;
       ++x->ndylibs;
       ord = x->ndylibs;
     }
     mi->dylib_ord = ord;
   }
 
   /* Always include every DSO input's install-name. */
   if (x->linker) {
     for (u32 ii = 0; ii < LinkInputs_count(&x->linker->inputs); ++ii) {
       LinkInput* in = LinkInputs_at(&x->linker->inputs, ii);
       if (in->kind != LINK_INPUT_DSO_BYTES) continue;
       if (in->soname == 0) continue;
       if (dylib_ordinal_of(x, in->soname)) continue;
       if (VEC_GROW(h, x->dylibs, cap_d, x->ndylibs + 1u))
         compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on dylibs");
       x->dylibs[x->ndylibs].install = in->soname;
       ++x->ndylibs;
     }
   }
 
   /* All entries so far are real imports; remember the partition point
    * so import/symtab table emit loops can skip the appended internals. */
   x->nimports_real = x->nimports;
 
   /* Internal GOT pass.  clang on Mach-O routes every extern-global
    * reference through the GOT (GOT_LOAD_PAGE21 / LD64_GOT_LO12_NC), so
    * even a common symbol or weak-undef that ends up resolved within the
    * image still needs a __got slot.  For each such reloc whose target
    * isn't an existing import, materialize a MachImp with internal=1.
    * The slot's contents are filled at write time and a chained-fixup
    * REBASE entry (or none, for weak undef → NULL) keeps it valid
    * post-ASLR. */
   for (u32 i = 0; i < LinkRelocs_count(&img->relocs); ++i) {
     LinkRelocApply* r = LinkRelocs_at(&img->relocs, i);
     if (!reloc_kind_is_got_load(x->c, r->kind)) continue;
     if (r->target == LINK_SYM_NONE || r->target >= x->sym_to_imp_size) continue;
     if (x->sym_to_imp[r->target]) continue;
     LinkSymbol* t = sym_at(img, r->target);
     if (!t) continue;
     /* Resolve through canonical so we share a single slot per symbol. */
     LinkSymId canon = r->target;
     if (t->name != 0) {
       LinkSymId hit = symhash_get(&img->globals, t->name);
       if (hit != LINK_SYM_NONE) {
         canon = hit;
         if (x->sym_to_imp[canon]) {
           x->sym_to_imp[r->target] = x->sym_to_imp[canon];
           continue;
         }
         t = sym_at(img, canon);
         if (!t) continue;
       }
     }
     if (VEC_GROW(h, x->imports, cap, x->nimports + 1u))
       compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on internal got");
     MachImp* mi = &x->imports[x->nimports++];
     memset(mi, 0, sizeof(*mi));
     mi->sym = canon;
     mi->name = t->name;
     mi->is_func = (t->kind == SK_FUNC || t->kind == SK_IFUNC) ? 1 : 0;
     mi->weak = (t->bind == SB_WEAK) ? 1 : 0;
     mi->internal = 1;
     x->sym_to_imp[canon] = x->nimports;
     if (canon != r->target) x->sym_to_imp[r->target] = x->nimports;
   }
 
   /* Assign stub_idx + got_idx.  Internal entries get a slot but no stub:
    * the call site (CALL26) on internal funcs goes direct, not via stub. */
   u32 stub_run = 0;
   for (u32 i = 0; i < x->nimports; ++i) {
     MachImp* mi = &x->imports[i];
     mi->got_idx = i + 1u;
     if (mi->is_func && !mi->internal) mi->stub_idx = ++stub_run;
   }
   x->nimport_funcs = stub_run;
 }
 
 /* ---- pass: collect TLV pointer slots ----
  *
  * Mirror of collect_imports' internal-GOT pass, but for TLV descriptors:
  * each unique descriptor referenced via ARM64_RELOC_TLVP_LOAD_PAGE21 /
  * PAGEOFF12 gets one slot in the synthetic __DATA,__thread_ptrs section.
  * The slot's runtime value is the descriptor's address; we patch it at
  * apply_relocs time (REBASE for in-image descriptors, BIND for ones in
  * a dylib).
  *
  * Slots are deduplicated by canonical LinkSymId so a single descriptor
  * referenced from N call sites shares one __thread_ptrs entry. */
 static void collect_tlv(MCtx* x) {
   LinkImage* img = x->img;
   Heap* h = x->h;
   x->sym_to_tlv_size = LinkSyms_count(&img->syms) + 1u;
   x->sym_to_tlv =
       (u32*)h->alloc(h, sizeof(u32) * x->sym_to_tlv_size, _Alignof(u32));
   if (!x->sym_to_tlv)
     compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on sym_to_tlv");
   memset(x->sym_to_tlv, 0, sizeof(u32) * x->sym_to_tlv_size);
 
   u32 cap = 0;
   for (u32 i = 0; i < LinkRelocs_count(&img->relocs); ++i) {
     LinkRelocApply* r = LinkRelocs_at(&img->relocs, i);
     if (!reloc_kind_is_tlvp(x->c, r->kind)) continue;
     if (r->target == LINK_SYM_NONE || r->target >= x->sym_to_tlv_size) continue;
     /* Resolve through canonical so multiple per-input duplicate undefs
      * collapse onto one __thread_ptrs slot. */
     LinkSymId canon = r->target;
     LinkSymbol* t = sym_at(img, r->target);
     if (!t) continue;
     if (t->name != 0) {
       LinkSymId hit = symhash_get(&img->globals, t->name);
       if (hit != LINK_SYM_NONE) {
         canon = hit;
         t = sym_at(img, canon);
         if (!t) continue;
       }
     }
     if (x->sym_to_tlv[canon]) {
       if (canon != r->target) x->sym_to_tlv[r->target] = x->sym_to_tlv[canon];
       continue;
     }
     if (VEC_GROW(h, x->tlv_slots, cap, x->ntlv + 1u))
       compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on tlv_slots");
     MachTlv* ts = &x->tlv_slots[x->ntlv++];
     memset(ts, 0, sizeof(*ts));
     ts->sym = canon;
     ts->tlv_idx = x->ntlv;
     ts->imported = t->imported ? 1u : 0u;
     /* If the descriptor is imported we route the bind through the
      * symbol's MachImp slot — that's where dyld's chained-import index
      * comes from.  When this loop fires the imp pass has already
      * materialized the entry (real imports were processed first); the
      * lookup may also have stashed an alias for non-canonical ids. */
     if (ts->imported) {
       u32 idx = (canon < x->sym_to_imp_size) ? x->sym_to_imp[canon] : 0u;
       if (!idx && t->name != 0) {
         LinkSymId hit2 = symhash_get(&img->globals, t->name);
         if (hit2 != LINK_SYM_NONE && hit2 < x->sym_to_imp_size)
           idx = x->sym_to_imp[hit2];
       }
       ts->import_idx = idx;
     }
     x->sym_to_tlv[canon] = x->ntlv;
     if (canon != r->target) x->sym_to_tlv[r->target] = x->ntlv;
   }
 }
 
 /* ---- pass: plan Mach-O sections ----
  *
  * Walks LinkImage sections.  Each non-zero-size LinkSection becomes one
  * MSec.  Synthetic __stubs and __got are appended at the right segment
  * boundaries.  Vaddr and file_offset are assigned in a single forward
  * pass starting at __TEXT base; __PAGEZERO and __LINKEDIT are special. */
 
 static void seg_init(MSeg* s, const char* name, u32 maxp, u32 initp) {
   memset(s, 0, sizeof(*s));
   s->name = name;
   s->maxprot = maxp;
   s->initprot = initp;
 }
 
 static int sec_is_writable(const LinkSection* ls) {
   return (ls->flags & SF_WRITE) != 0u;
 }
 static int sec_is_exec(const LinkSection* ls) {
   return (ls->flags & SF_EXEC) != 0u;
 }
 static int sec_is_zerofill(const LinkSection* ls) {
   return ls->sem == SSEM_NOBITS;
 }
 
 static int section_has_abs64_reloc(const LinkImage* img, LinkSectionId id) {
   for (u32 i = 0; i < LinkRelocs_count(&img->relocs); ++i) {
     const LinkRelocApply* r = LinkRelocs_at(&img->relocs, i);
     if (r->link_section_id == id && r->kind == R_ABS64) return 1;
   }
   return 0;
 }
 
 static int sec_needs_data_const(const LinkImage* img, const LinkSection* ls) {
   if (!ls || !ls->size || sec_is_exec(ls) || sec_is_writable(ls) ||
       sec_is_zerofill(ls)) {
     return 0;
   }
   return section_has_abs64_reloc(img, ls->id);
 }
 
 /* Pick (segname, sectname) for a LinkSection.  Comma-form Mach-O names
  * round-trip into MSec's inline 16-byte buffers; literal defaults point
  * at .rodata strings.  Caller passes the MSec for per-section storage —
  * a previous version used a shared static buffer which aliased all
  * sections to whichever name was set last. */
 static void pick_macho_names(const LinkSection* ls, Compiler* c, MSec* m) {
   Slice nm_s = pool_slice(c->global, ls->name);
   const char* nm = nm_s.s;
   size_t nlen = nm_s.len;
   if (nm) {
     /* Comma-form: "__SEG,__sect" round-tripped from a Mach-O input. */
     for (size_t i = 0; i < nlen; ++i) {
       if (nm[i] == ',') {
         u32 seg_n = (u32)(i > 16 ? 16 : i);
         memcpy(m->segname_buf, nm, seg_n);
         m->segname_buf[seg_n] = 0;
         u32 sect_n = (u32)((nlen - i - 1) > 16 ? 16 : (nlen - i - 1));
         memcpy(m->sectname_buf, nm + i + 1, sect_n);
         m->sectname_buf[sect_n] = 0;
         m->segname = m->segname_buf;
         m->sectname = m->sectname_buf;
         return;
       }
     }
   }
   /* Derive from flags. */
   if (sec_is_exec(ls)) {
     m->segname = "__TEXT";
     m->sectname = "__text";
   } else if (sec_is_writable(ls)) {
     m->segname = "__DATA";
     m->sectname = sec_is_zerofill(ls) ? "__bss" : "__data";
   } else {
     m->segname = "__TEXT";
     m->sectname = "__const";
   }
 }
 
 static void plan_layout(MCtx* x) {
   LinkImage* img = x->img;
   Heap* h = x->h;
 
   /* PAGEZERO */
   seg_init(&x->segs[0], "__PAGEZERO", 0, 0);
   x->segs[0].vmaddr = 0;
   x->segs[0].vmsize = MZ_PAGEZERO;
   x->segs[0].fileoff = 0;
   x->segs[0].filesize = 0;
   x->segs[0].nsects = 0;
   x->segs[0].first_sec = 0;
 
   /* Segments 1..4 */
   seg_init(&x->segs[1], "__TEXT", VM_PROT_READ | VM_PROT_EXECUTE,
            VM_PROT_READ | VM_PROT_EXECUTE);
   seg_init(&x->segs[2], "__DATA_CONST", VM_PROT_READ | VM_PROT_WRITE,
            VM_PROT_READ | VM_PROT_WRITE);
   seg_init(&x->segs[3], "__DATA", VM_PROT_READ | VM_PROT_WRITE,
            VM_PROT_READ | VM_PROT_WRITE);
   /* __DWARF holds the file-only .debug_* sections; mapped R but never
    * referenced at runtime. Empty (nsects 0) when there's no debug info. */
   seg_init(&x->segs[MSEG_DWARF], "__DWARF", VM_PROT_READ, VM_PROT_READ);
   seg_init(&x->segs[MSEG_LINKEDIT], "__LINKEDIT", VM_PROT_READ, VM_PROT_READ);
   x->nsegs = MSEG_COUNT;
 
   /* Pre-allocate MSec capacity: every LinkSection + 2 synth (__stubs,
    * __got).  (LinkSections from the dynamic-link layer — .dynsym / .plt
    * etc. — were synthesized by layout_dyn for ELF; we won't have them
    * since pie wasn't set on this Linker.  Still, oversize by a few.) */
   u32 cap = LinkRelocs_count(&img->relocs) + img->nsections + 4u;
   x->secs = (MSec*)h->alloc(h, sizeof(MSec) * cap, _Alignof(MSec));
   if (!x->secs) compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on MSec");
   memset(x->secs, 0, sizeof(MSec) * cap);
   x->nsecs = 0;
 
   /* Pass 1: __TEXT segment.  Header + loadcmds reserve front. */
   /* We need the exact header_size to set first sec's file_offset.  We'll
    * compute it later, but reserve a placeholder; for now use 0 and patch
    * in pass 4 (offsets get bumped). */
 
   u64 text_vaddr = MZ_PAGEZERO;
   /* We'll compute headers_size after plan; stash starting vaddr only. */
   x->segs[1].vmaddr = text_vaddr;
   x->segs[1].fileoff = 0;
   x->text_vaddr = text_vaddr;
 
   /* Collect: (a) exec sections, (b) read-only allocatable sections. */
   /* (cursor advances per-segment in pass 2; nothing to track here) */
 
   /* We don't know the header size yet; walk sections first to enumerate
    * MSec entries, then back-fill file_offset/vaddr after we know the
    * load-command count. */
 
   u32 first_text_sec = x->nsecs;
 
   for (u32 i = 0; i < img->nsections; ++i) {
     LinkSection* ls = &img->sections[i];
     if (!ls->size) continue;
     if (ls->file_only) continue; /* .debug_* → __DWARF segment below */
     if (sec_is_writable(ls)) continue;
     if (sec_is_zerofill(ls)) continue; /* placed in __DATA */
     if (sec_needs_data_const(img, ls)) continue;
     MSec* m = &x->secs[x->nsecs++];
     memset(m, 0, sizeof(*m));
     m->link_sec_id = ls->id;
     pick_macho_names(ls, x->c, m);
     /* Force into __TEXT. */
     if (!slice_eq_cstr(slice_from_cstr(m->segname), "__TEXT"))
       m->segname = "__TEXT";
     m->align = ls->align ? ls->align : 1u;
     m->size = ls->size;
     m->segidx = 1;
     m->flags = sec_is_exec(ls) ? (0x80000000u /*S_ATTR_PURE_INSTRUCTIONS*/ |
                                   0x00000400u /*S_ATTR_SOME_INSTRUCTIONS*/)
                                : 0u;
   }
 
   /* __stubs synthetic */
   if (x->nimport_funcs) {
     x->stubs_size = x->nimport_funcs * x->macho->stub_size;
     x->stubs_bytes = (u8*)h->alloc(h, x->stubs_size, 4);
     if (!x->stubs_bytes)
       compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on stubs");
     memset(x->stubs_bytes, 0, x->stubs_size);
     MSec* m = &x->secs[x->nsecs++];
     memset(m, 0, sizeof(*m));
     m->synth_data = x->stubs_bytes;
     m->synth_size = x->stubs_size;
     m->segname = "__TEXT";
     m->sectname = "__stubs";
     m->align = 4u;
     m->size = x->stubs_size;
     m->segidx = 1;
     m->flags = 0x80000000u | 0x00000400u | 0x00000008u /*S_SYMBOL_STUBS*/;
     m->reserved1 = 0; /* fill in later: indirect-symtab base */
     m->reserved2 = x->macho->stub_size;
   }
   x->segs[1].nsects = x->nsecs - first_text_sec;
   x->segs[1].first_sec = first_text_sec;
 
   /* __DATA_CONST: __got synth */
   u32 first_dc = x->nsecs;
   if (x->nimports) {
     x->got_size = x->nimports * MZ_GOT_SIZE;
     x->got_bytes = (u8*)h->alloc(h, x->got_size, 8);
     if (!x->got_bytes)
       compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on got");
     memset(x->got_bytes, 0, x->got_size);
     MSec* m = &x->secs[x->nsecs++];
     memset(m, 0, sizeof(*m));
     m->synth_data = x->got_bytes;
     m->synth_size = x->got_size;
     m->segname = "__DATA_CONST";
     m->sectname = "__got";
     m->align = 8u;
     m->size = x->got_size;
     m->segidx = 2;
     m->flags = 0x00000006u /*S_NON_LAZY_SYMBOL_POINTERS*/;
     m->reserved1 = 0; /* indirect-symtab base */
   }
   for (u32 i = 0; i < img->nsections; ++i) {
     LinkSection* ls = &img->sections[i];
     if (ls->file_only) continue; /* .debug_* → __DWARF (has ABS64 relocs) */
     if (!sec_needs_data_const(img, ls)) continue;
     MSec* m = &x->secs[x->nsecs++];
     memset(m, 0, sizeof(*m));
     m->link_sec_id = ls->id;
     pick_macho_names(ls, x->c, m);
     m->segname = "__DATA_CONST";
     m->align = ls->align ? ls->align : 1u;
     m->size = ls->size;
     m->segidx = 2;
     m->flags = 0;
   }
   x->segs[2].nsects = x->nsecs - first_dc;
   x->segs[2].first_sec = first_dc;
 
   /* __DATA segment: writable sections + zerofill. */
   u32 first_d = x->nsecs;
   for (u32 i = 0; i < img->nsections; ++i) {
     LinkSection* ls = &img->sections[i];
     if (ls->file_only) continue; /* .debug_* → __DWARF */
     if (!ls->size && !sec_is_zerofill(ls)) continue;
     if (!sec_is_writable(ls)) continue;
     MSec* m = &x->secs[x->nsecs++];
     memset(m, 0, sizeof(*m));
     m->link_sec_id = ls->id;
     pick_macho_names(ls, x->c, m);
     if (!slice_eq_cstr(slice_from_cstr(m->segname), "__DATA"))
       m->segname = "__DATA";
     m->align = ls->align ? ls->align : 1u;
     m->size = ls->size;
     m->segidx = 3;
     m->is_zerofill = sec_is_zerofill(ls) ? 1 : 0;
     m->flags = m->is_zerofill ? 0x00000001u /*S_ZEROFILL*/ : 0;
     /* dyld dispatches on the section type byte (low 8 bits of flags).
      * __mod_init_func / __mod_term_func sections must carry the
      * S_MOD_INIT_FUNC_POINTERS / S_MOD_TERM_FUNC_POINTERS type or dyld
      * skips them entirely — leaving constructors unrun at startup. */
     if (slice_eq_cstr(slice_from_cstr(m->sectname), "__mod_init_func"))
       m->flags = 0x00000009u /*S_MOD_INIT_FUNC_POINTERS*/;
     else if (slice_eq_cstr(slice_from_cstr(m->sectname), "__mod_term_func"))
       m->flags = 0x0000000au /*S_MOD_TERM_FUNC_POINTERS*/;
     else if (ls->flags & SF_TLS) {
       /* TLV sections: dyld dispatches by section type, not name.  Map
        * __thread_vars → S_THREAD_LOCAL_VARIABLES (descriptor records),
        * __thread_data → S_THREAD_LOCAL_REGULAR (initial data),
        * __thread_bss → S_THREAD_LOCAL_ZEROFILL (zero-init data).  Done
        * by sectname so per-TU inputs without a Mach-O ext_type still
        * get the right section type. */
       if (slice_eq_cstr(slice_from_cstr(m->sectname), "__thread_vars")) {
         m->flags = S_THREAD_LOCAL_VARIABLES;
         /* Each descriptor is three pointers (24B) whose first word is
          * dyld's _tlv_bootstrap thunk pointer.  Clang/llvm emit
          * __thread_vars with on-disk alignment 1 (relying on layout to
          * land it on 8); force 8-alignment here so the descriptor
          * pointers fall on 8-byte boundaries — dyld's chained-fixup
          * processing assumes that. */
         if (m->align < 8u) m->align = 8u;
       } else if (m->is_zerofill)
         m->flags = S_THREAD_LOCAL_ZEROFILL;
       else
         m->flags = S_THREAD_LOCAL_REGULAR;
     }
   }
   /* __thread_ptrs synthetic (TLV pointer slots).  Emitted into __DATA
    * after the user's TLV input sections so descriptors and their
    * pointers share the same segment.  Each slot's runtime initial
    * value (= TLV descriptor address) is patched during apply_relocs. */
   if (x->ntlv) {
     x->tlv_ptrs_size = x->ntlv * MZ_TLVP_SIZE;
     x->tlv_ptrs_bytes = (u8*)h->alloc(h, x->tlv_ptrs_size, 8);
     if (!x->tlv_ptrs_bytes)
       compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on tlv_ptrs");
     memset(x->tlv_ptrs_bytes, 0, x->tlv_ptrs_size);
     MSec* m = &x->secs[x->nsecs++];
     memset(m, 0, sizeof(*m));
     m->synth_data = x->tlv_ptrs_bytes;
     m->synth_size = x->tlv_ptrs_size;
     m->segname = "__DATA";
     m->sectname = "__thread_ptrs";
     m->align = 8u;
     m->size = x->tlv_ptrs_size;
     m->segidx = 3;
     m->flags = S_THREAD_LOCAL_VARIABLE_POINTERS;
   }
   x->segs[3].nsects = x->nsecs - first_d;
   x->segs[3].first_sec = first_d;
 
   /* __DWARF: file-only .debug_* sections (debug-info retention). Each
    * contribution becomes a synth MSec whose bytes are the per-image
    * debug registry buffer (relocs applied in place at apply_relocs).
    * Iterated in registry order (= input order) so same-name runs land
    * adjacent and the per-input DWARF-relative bases line up with the
    * coalesced section's byte layout. */
   u32 first_dw = x->nsecs;
   for (u32 i = 0; i < img->nsections; ++i) {
     LinkSection* ls = &img->sections[i];
     u8* dbg;
     if (!ls->file_only || !ls->size) continue;
     dbg = link_fileonly_bytes(img, ls->id);
     if (!dbg) continue;
     MSec* m = &x->secs[x->nsecs++];
     memset(m, 0, sizeof(*m));
     m->synth_data = dbg;
     m->synth_size = (u32)ls->size;
     /* Section name: a Mach-O input already carries "__DWARF,__debug_*";
      * an in-process .debug_* maps via obj_macho_debug_sectname. */
     {
       Slice nm = pool_slice(x->c->global, ls->name);
       const char* comma = nm.s ? memchr(nm.s, ',', nm.len) : NULL;
       char sect[17];
       if (comma) {
         u32 sgn = (u32)(comma - nm.s);
         if (sgn > 16u) sgn = 16u;
         memcpy(m->segname_buf, nm.s, sgn);
         m->segname_buf[sgn] = 0;
         u32 stn = (u32)(nm.len - (comma - nm.s) - 1);
         if (stn > 16u) stn = 16u;
         memcpy(m->sectname_buf, comma + 1, stn);
         m->sectname_buf[stn] = 0;
       } else if (obj_macho_debug_sectname(nm.s, nm.len, sect)) {
         memcpy(m->segname_buf, "__DWARF", 8);
         memcpy(m->sectname_buf, sect, slice_from_cstr(sect).len + 1);
       } else {
         memcpy(m->segname_buf, "__DWARF", 8);
         u32 stn = nm.len > 16u ? 16u : (u32)nm.len;
         memcpy(m->sectname_buf, nm.s, stn);
         m->sectname_buf[stn] = 0;
       }
       m->segname = m->segname_buf;
       m->sectname = m->sectname_buf;
     }
     /* align 1: contributions concatenate gap-free so the DWARF-relative
      * bases (assigned without padding in link_layout_debug) stay valid. */
     m->align = 1u;
     m->size = ls->size;
     m->segidx = MSEG_DWARF;
     m->flags = 0; /* S_REGULAR */
   }
   x->segs[MSEG_DWARF].nsects = x->nsecs - first_dw;
   x->segs[MSEG_DWARF].first_sec = first_dw;
 
   /* Group MSecs by (segname, sectname) within each segment so vaddr
    * placement keeps same-named runs contiguous.  Otherwise Phase B's
    * adjacency-based coalescing splits a single Mach-O section into
    * multiple OutSecs (e.g. `.text` from an in-memory ObjBuilder and
    * `__TEXT,__text` from a Mach-O .o input both map to `__TEXT,__text`
    * but arrive in separate link_layout groups, interleaved with other
    * sections from each input).  Stable insertion sort preserves input
    * order within a name, which matters for synth __stubs/__thread_ptrs
    * order relative to peers. */
   for (u32 i = 0; i < x->nsegs; ++i) {
     MSeg* sg = &x->segs[i];
     if (sg->nsects < 2) continue;
     u32 base = sg->first_sec;
     u32 n = sg->nsects;
     for (u32 a = 1; a < n; ++a) {
       MSec key = x->secs[base + a];
       msec_repair_name_ptrs(&key);
       u32 j = a;
       while (j > 0) {
         MSec* prev = &x->secs[base + j - 1];
         /* Ordering compare for stable sort: slices don't order, keep strcmp. */
         int cmp = strcmp(prev->segname, key.segname);             /* ordering */
         if (cmp == 0) cmp = strcmp(prev->sectname, key.sectname); /* ordering */
         if (cmp <= 0) break;
         x->secs[base + j] = x->secs[base + j - 1];
         msec_repair_name_ptrs(&x->secs[base + j]);
         --j;
       }
       x->secs[base + j] = key;
       msec_repair_name_ptrs(&x->secs[base + j]);
     }
   }
 
   /* Phase A: count OutSecs per segment (distinct sectnames) so we can
    * size the load commands before placing vaddrs.  Phase B builds the
    * actual OutSec[] after placement, when vaddrs are final. */
   for (u32 i = 0; i < x->nsegs; ++i) {
     MSeg* sg = &x->segs[i];
     u32 cnt = 0;
     for (u32 a = sg->first_sec; a < sg->first_sec + sg->nsects; ++a) {
       int seen = 0;
       for (u32 b = sg->first_sec; b < a; ++b) {
         if (slice_eq_cstr(slice_from_cstr(x->secs[a].sectname),
                           x->secs[b].sectname) &&
             slice_eq_cstr(slice_from_cstr(x->secs[a].segname),
                           x->secs[b].segname)) {
           seen = 1;
           break;
         }
       }
       if (!seen) ++cnt;
     }
     sg->nouts = cnt;
     sg->first_out = 0; /* assigned in Phase B */
   }
 
   /* Compute load-command count + sizeofcmds, then back-fill section
    * offsets.  Layout pass 2. */
   u32 nseg_real = 0;
   for (u32 i = 0; i < x->nsegs; ++i) {
     /* Skip __DATA_CONST or __DATA if no sections (edge case). */
     if (i == 0) {
       ++nseg_real;
       continue;
     } /* PAGEZERO */
     if (i == MSEG_LINKEDIT) {
       ++nseg_real;
       continue;
     } /* LINKEDIT always */
     if (x->segs[i].nsects > 0) ++nseg_real; /* incl. __DWARF when present */
   }
   /* Each LC_SEGMENT_64 carries 72 + 80*nouts bytes (one section_64
    * record per coalesced (segname,sectname), not per MSec). */
   u32 sizeofcmds = 0;
   for (u32 i = 0; i < x->nsegs; ++i) {
     if (i == 0 || i == MSEG_LINKEDIT) {
       sizeofcmds += MACHO_SEGCMD64_SIZE; /* no sections */
       continue;
     }
     if (x->segs[i].nsects == 0) continue;
     sizeofcmds += MACHO_SEGCMD64_SIZE + x->segs[i].nouts * MACHO_SECT64_SIZE;
   }
   (void)nseg_real;
   /* LC_DYLD_CHAINED_FIXUPS / LC_DYLD_EXPORTS_TRIE */
   sizeofcmds += 16u + 16u;
   /* LC_SYMTAB / LC_DYSYMTAB */
   sizeofcmds += MACHO_SYMTAB_CMD_SIZE + MACHO_DYSYMTAB_CMD_SIZE;
   /* LC_LOAD_DYLINKER */
   {
     u32 ld_size = 12u + (u32)(sizeof("/usr/lib/dyld") - 1u) + 1u;
     sizeofcmds += (u32)ALIGN_UP((u64)ld_size, 8u);
   }
   /* LC_UUID + LC_BUILD_VERSION + LC_MAIN */
   sizeofcmds += 24u + 24u + 24u;
   /* LC_LOAD_DYLIB per dylib */
   for (u32 i = 0; i < x->ndylibs; ++i) {
     size_t nl = pool_slice(x->c->global, x->dylibs[i].install).len;
     u32 sz = 24u + (u32)nl + 1u;
     sizeofcmds += (u32)ALIGN_UP((u64)sz, 8u);
   }
   /* LC_FUNCTION_STARTS / LC_DATA_IN_CODE / LC_CODE_SIGNATURE */
   sizeofcmds += 16u + 16u + 16u;
 
   x->headers_size = MACHO_HDR64_SIZE + sizeofcmds;
 
   /* Now place sections in __TEXT, __DATA_CONST, __DATA. */
   u64 vaddr = MZ_PAGEZERO + x->headers_size;
   u64 fileoff = x->headers_size;
   /* Pad __TEXT sections to natural alignment. */
   for (u32 i = 0; i < x->nsegs; ++i) {
     if (i == 0 || i == MSEG_LINKEDIT) continue; /* DWARF placed here too */
     MSeg* sg = &x->segs[i];
     if (i > 1) {
       /* page-align the start of __DATA_CONST and __DATA */
       vaddr = ALIGN_UP(vaddr, MZ_PAGE);
       fileoff = ALIGN_UP(fileoff, MZ_PAGE);
     }
     sg->vmaddr = (i == 1) ? MZ_PAGEZERO : vaddr;
     sg->fileoff = (i == 1) ? 0 : fileoff;
     /* __TEXT carries the headers_size + sections. */
     u64 seg_start_v = sg->vmaddr;
     u64 seg_start_f = sg->fileoff;
     /* For __TEXT, sections begin after the header area. */
     u64 cur_v = (i == 1) ? (seg_start_v + x->headers_size) : seg_start_v;
     u64 cur_f = (i == 1) ? (seg_start_f + x->headers_size) : seg_start_f;
     u64 first_zerofill_v = 0;
     int seen_zerofill = 0;
     /* Non-zerofill first */
     for (u32 j = 0; j < sg->nsects; ++j) {
       MSec* m = &x->secs[sg->first_sec + j];
       if (m->is_zerofill) continue;
       cur_v = ALIGN_UP(cur_v, (u64)m->align);
       cur_f = ALIGN_UP(cur_f, (u64)m->align);
       m->vaddr = cur_v;
       m->file_offset = cur_f;
       cur_v += m->size;
       cur_f += m->size;
     }
     first_zerofill_v = cur_v;
     /* zerofill last (no file bytes) */
     for (u32 j = 0; j < sg->nsects; ++j) {
       MSec* m = &x->secs[sg->first_sec + j];
       if (!m->is_zerofill) continue;
       cur_v = ALIGN_UP(cur_v, (u64)m->align);
       m->vaddr = cur_v;
       m->file_offset = 0;
       cur_v += m->size;
       seen_zerofill = 1;
     }
     sg->filesize = (i == 1)
                        ? (cur_f - seg_start_f)
                        : (first_zerofill_v ? (first_zerofill_v - seg_start_v)
                                            : (cur_v - seg_start_v));
     sg->vmsize = ALIGN_UP(cur_v - seg_start_v, MZ_PAGE);
     if (sg->vmsize == 0 && sg->nsects > 0) sg->vmsize = MZ_PAGE;
     if (i == 1) {
       x->stubs_vaddr = 0;
       for (u32 j = 0; j < sg->nsects; ++j) {
         MSec* m = &x->secs[sg->first_sec + j];
         if (slice_eq_cstr(slice_from_cstr(m->sectname), "__stubs"))
           x->stubs_vaddr = m->vaddr;
       }
     }
     if (i == 2) {
       for (u32 j = 0; j < sg->nsects; ++j) {
         MSec* m = &x->secs[sg->first_sec + j];
         if (slice_eq_cstr(slice_from_cstr(m->sectname), "__got"))
           x->got_vaddr = m->vaddr;
       }
     }
     if (i == 3) {
       for (u32 j = 0; j < sg->nsects; ++j) {
         MSec* m = &x->secs[sg->first_sec + j];
         if (slice_eq_cstr(slice_from_cstr(m->sectname), "__thread_ptrs"))
           x->tlv_ptrs_vaddr = m->vaddr;
         /* TLS storage image base: min vaddr across __thread_data and
          * __thread_bss sections.  __thread_vars is excluded — it holds
          * the descriptors, not the data that maps into the per-thread
          * block. */
         if ((slice_eq_cstr(slice_from_cstr(m->sectname), "__thread_data") ||
              slice_eq_cstr(slice_from_cstr(m->sectname), "__thread_bss")) &&
             (!x->has_tls_image || m->vaddr < x->tls_image_vaddr)) {
           x->tls_image_vaddr = m->vaddr;
           x->has_tls_image = 1;
         }
       }
     }
     vaddr = sg->vmaddr + sg->vmsize;
     /* Mach-O segments are mapped in page units.  If a segment's memory
      * image extends past its initialized file bytes (for example
      * __DATA,__bss), the following segment's fileoff must not reuse those
      * pages or the kernel can map later file contents into the zero-fill
      * tail. */
     fileoff = sg->fileoff + ((sg->vmsize > ALIGN_UP(sg->filesize, MZ_PAGE))
                                  ? sg->vmsize
                                  : sg->filesize);
     (void)seen_zerofill;
   }
   /* LINKEDIT placeholder; size is filled after blob assembly. */
   vaddr = ALIGN_UP(vaddr, MZ_PAGE);
   fileoff = ALIGN_UP(fileoff, MZ_PAGE);
   x->segs[MSEG_LINKEDIT].vmaddr = vaddr;
   x->segs[MSEG_LINKEDIT].fileoff = fileoff;
   x->linkedit_vaddr = vaddr;
   x->linkedit_fileoff = fileoff;
 
   /* Encode __stubs bytes now that vaddrs are settled.  Internal-GOT
    * entries have stub_idx=0 (direct CALL26, no stub) and must be
    * skipped so the (stub_idx - 1u) arithmetic doesn't wrap. */
   for (u32 i = 0; i < x->nimports; ++i) {
     MachImp* mi = &x->imports[i];
     if (!mi->is_func || !mi->stub_idx) continue;
     u64 stub_v = x->stubs_vaddr + (mi->stub_idx - 1u) * x->macho->stub_size;
     u64 got_v = x->got_vaddr + (mi->got_idx - 1u) * MZ_GOT_SIZE;
     x->macho->emit_stub(
         x->stubs_bytes + (mi->stub_idx - 1u) * x->macho->stub_size, stub_v,
         got_v);
   }
 
   /* Phase B: build OutSec[] now that all MSec vaddrs are final.  Walk
    * MSecs sorted by (segidx, vaddr) and coalesce adjacent same-name
    * runs.  Mirrors link_elf.c's OutShdr build at link_elf.c:879. */
   {
     u32* order =
         (u32*)h->alloc(h, sizeof(u32) * (x->nsecs + 1u), _Alignof(u32));
     if (!order && x->nsecs)
       compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on outsec sort");
     for (u32 i = 0; i < x->nsecs; ++i) order[i] = i;
     /* Insertion sort — section count is small. */
     for (u32 i = 1; i < x->nsecs; ++i) {
       u32 cur = order[i];
       MSec* a = &x->secs[cur];
       u32 j = i;
       while (j > 0) {
         MSec* b = &x->secs[order[j - 1]];
         if ((b->segidx < a->segidx) ||
             (b->segidx == a->segidx && b->vaddr <= a->vaddr))
           break;
         order[j] = order[j - 1];
         --j;
       }
       order[j] = cur;
     }
     u32 cap = x->nsecs + 1u;
     x->outs = (OutSec*)h->alloc(h, sizeof(OutSec) * cap, _Alignof(OutSec));
     if (!x->outs)
       compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on OutSec");
     memset(x->outs, 0, sizeof(OutSec) * cap);
     x->nouts = 0;
     for (u32 i = 0; i < x->nsecs; ++i) {
       MSec* m = &x->secs[order[i]];
       OutSec* tail = x->nouts ? &x->outs[x->nouts - 1] : NULL;
       int merge = tail && tail->segidx == m->segidx &&
                   slice_eq_cstr(slice_from_cstr(tail->sectname), m->sectname) &&
                   slice_eq_cstr(slice_from_cstr(tail->segname), m->segname);
       if (merge) {
         if (tail->flags != m->flags || tail->is_zerofill != m->is_zerofill)
           compiler_panic(
               x->c, SRCLOC_NONE,
               "link_macho: coalesce mismatch on %.*s,%.*s (flags/zerofill)",
               SLICE_ARG(slice_from_cstr(m->segname)),
               SLICE_ARG(slice_from_cstr(m->sectname)));
         u64 end = m->vaddr + m->size;
         u64 prev_end = tail->vaddr + tail->size;
         if (end > prev_end) tail->size = end - tail->vaddr;
         if (m->align > tail->align) tail->align = m->align;
       } else {
         OutSec* o = &x->outs[x->nouts++];
         o->segname = m->segname;
         o->sectname = m->sectname;
         o->vaddr = m->vaddr;
         o->file_offset = m->file_offset;
         o->size = m->size;
         o->align = m->align;
         o->flags = m->flags;
         o->reserved1 = m->reserved1;
         o->reserved2 = m->reserved2;
         o->segidx = m->segidx;
         o->is_zerofill = m->is_zerofill;
       }
     }
     h->free(h, order, sizeof(u32) * (x->nsecs + 1u));
     /* Recompute per-segment OutSec span; Phase A's count was for
      * sizeofcmds sizing — recompute it here as the source of truth and
      * assert agreement. */
     for (u32 i = 0; i < x->nsegs; ++i) {
       x->segs[i].first_out = 0;
     }
     u32 prev_nouts[MSEG_COUNT];
     for (u32 i = 0; i < x->nsegs; ++i) prev_nouts[i] = x->segs[i].nouts;
     for (u32 i = 0; i < x->nsegs; ++i) x->segs[i].nouts = 0;
     for (u32 i = 0; i < x->nouts; ++i) {
       u8 sx = x->outs[i].segidx;
       if (x->segs[sx].nouts == 0) x->segs[sx].first_out = i;
       ++x->segs[sx].nouts;
     }
     for (u32 i = 0; i < x->nsegs; ++i) {
       if (prev_nouts[i] != x->segs[i].nouts)
         compiler_panic(x->c, SRCLOC_NONE,
                        "link_macho: OutSec count drift seg %u (%u vs %u)",
                        (u32)i, prev_nouts[i], x->segs[i].nouts);
     }
   }
 }
 
 /* ---- pass: shift LinkImage into final vaddrs/file_offsets ----
  *
  * The sections in img->sections are still in their original
  * link_layout coordinates.  Map each LinkSection -> its MSec and copy
  * the final vaddr/file_offset so reloc-apply walks correctly. */
 
 /* link_sec_id -> backing MSec index, built once. */
 static void build_section_index(MCtx* x) {
   u32 n = x->img->nsections;
   x->by_link_sec_cap = n + 1u;
   x->by_link_sec =
       (MSec**)x->h->alloc(x->h, sizeof(MSec*) * x->by_link_sec_cap,
                           _Alignof(MSec*));
   if (!x->by_link_sec)
     compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on section index");
   for (u32 i = 0; i < x->by_link_sec_cap; ++i) x->by_link_sec[i] = NULL;
   for (u32 i = 0; i < x->nsecs; ++i) {
     MSec* m = &x->secs[i];
     if (m->link_sec_id && m->link_sec_id < x->by_link_sec_cap)
       x->by_link_sec[m->link_sec_id] = m;
   }
 }
 
 /* Re-base every section to its final Mach-O vaddr/file_offset, then shift the
  * relocs and defined symbols anchored to each section by its per-section delta.
  * A per-section delta table + three single passes (O(nsecs + nrelocs + nsyms))
  * replaces the former per-section rescan of the whole reloc + sym vectors
  * (O(nsecs * (nrelocs + nsyms)) — the dominant obj-count superlinearity). The
  * ELF emitter (src/obj/elf/link.c) is the reference; this generalizes it to
  * per-section deltas because Mach-O segments get different bases. */
 static void shift_sections(MCtx* x) {
   LinkImage* img = x->img;
   u32 n = img->nsections;
   i64* dv = (i64*)x->h->alloc(x->h, sizeof(i64) * (n + 1u), _Alignof(i64));
   i64* df = (i64*)x->h->alloc(x->h, sizeof(i64) * (n + 1u), _Alignof(i64));
   if (!dv || !df)
     compiler_panic(x->c, SRCLOC_NONE, "link_macho: oom on shift deltas");
   for (u32 i = 0; i <= n; ++i) {
     dv[i] = 0;
     df[i] = 0;
   }
   /* Per-section deltas; re-base each LinkSection. Sections keyed by id (the
    * same id relocs/syms carry), matching the former ls->id match. */
   for (u32 i = 0; i < x->nsecs; ++i) {
     MSec* m = &x->secs[i];
     LinkSection* ls;
     u32 id;
     if (!m->link_sec_id) continue;
     ls = &img->sections[m->link_sec_id - 1u];
     id = ls->id;
     if (id == 0 || id > n) continue;
     dv[id] = (i64)m->vaddr - (i64)ls->vaddr;
     df[id] = (i64)m->file_offset - (i64)ls->file_offset;
     ls->vaddr = m->vaddr;
     ls->file_offset = m->file_offset;
   }
   /* Shift relocs by their section's delta (0 == no shift, was the early-out). */
   for (u32 ri = 0; ri < LinkRelocs_count(&img->relocs); ++ri) {
     LinkRelocApply* r = LinkRelocs_at(&img->relocs, ri);
     u32 id = r->link_section_id;
     if (id == LINK_SEC_NONE || id > n) continue;
     r->write_vaddr = (u64)((i64)r->write_vaddr + dv[id]);
     r->write_file_offset = (u64)((i64)r->write_file_offset + df[id]);
   }
   /* Shift defined, non-absolute symbols. Match by section_id (multiple input
    * sections may share a pre-shift vaddr; the bucket each starts at offset 0). */
   for (u32 si = 0; si < LinkSyms_count(&img->syms); ++si) {
     LinkSymbol* s = LinkSyms_at(&img->syms, si);
     u32 id;
     if (!s->defined || s->kind == SK_ABS) continue;
     id = s->section_id;
     if (id == LINK_SEC_NONE || id > n) continue;
     s->vaddr = (u64)((i64)s->vaddr + dv[id]);
   }
   x->h->free(x->h, dv, sizeof(i64) * (n + 1u));
   x->h->free(x->h, df, sizeof(i64) * (n + 1u));
 }
 
 /* ---- pass: apply relocations + collect chained-fixup sites ----
  *
  * Reloc dispatch:
  *   target=imported func + CALL26/JUMP26 -> S = stub vaddr
  *   target=import + GOT_LOAD_PAGE21/PAGEOFF12 -> S = got slot vaddr
  *   target=import + ABS64 -> write 0; collect bind site
  *   target=internal + ABS64 -> write target VA; collect rebase site
  *   everything else -> standard apply
  *
  * Patch sites for chained fixups are 8-byte slots; for ABS32 we do not
  * support fixups (no chained-fixup format for 32-bit pointers in
  * standard arm64 — would need DYLD_CHAINED_PTR_32).  Internal R_ABS32
  * still works (no slide adjustment is wrong technically, but for
  * compile-time-known offsets it suffices).
  */
 
 typedef struct FixSite {
   u8 segidx;  /* 2 = __DATA_CONST, 3 = __DATA */
   u8 is_bind; /* 0 = rebase, 1 = bind */
   u8 pad[2];
   u32 import_idx;    /* 1-based import index for binds, 0 for rebases */
   u64 vaddr;         /* absolute VA of the slot */
   u64 rebase_target; /* unslid target VA; only used for rebases */
 } FixSite;
 
 typedef struct FixList {
   Heap* heap;
   FixSite* a;
   u32 n;
   u32 cap;
 } FixList;
 
 static void fix_init(FixList* fl, Heap* h) {
   fl->heap = h;
   fl->a = NULL;
   fl->n = 0;
   fl->cap = 0;
 }
 static void fix_fini(FixList* fl) {
   if (fl->a) fl->heap->free(fl->heap, fl->a, sizeof(*fl->a) * fl->cap);
   fl->a = NULL;
   fl->n = fl->cap = 0;
 }
 static void fix_push(FixList* fl, const FixSite* s) {
   if (VEC_GROW(fl->heap, fl->a, fl->cap, fl->n + 1u)) return;
   fl->a[fl->n++] = *s;
 }
 
 /* find MSec covering an absolute vaddr */
 static MSec* msec_for_vaddr(MCtx* x, u64 v) {
   for (u32 i = 0; i < x->nsecs; ++i) {
     MSec* m = &x->secs[i];
     if (v >= m->vaddr && v < m->vaddr + m->size) return m;
   }
   return NULL;
 }
 
 static u8* bytes_for_section(MCtx* x, MSec* m, LinkImage* img) {
   if (m->synth_data) {
     /* Synthetic — caller reads/writes via x->stubs_bytes / x->got_bytes. */
     if (m->synth_data == x->stubs_bytes) return x->stubs_bytes;
     if (m->synth_data == x->got_bytes) return x->got_bytes;
     return NULL;
   }
   /* Backed by a LinkSection: find the LinkSegment buffer that section
    * sits in (link_layout.c stored input section bytes there). */
   LinkSection* ls = &img->sections[m->link_sec_id - 1u];
   u32 segid = ls->segment_id;
   if (segid == LINK_SEG_NONE) return NULL;
   return img->segment_bytes[segid - 1u];
 }
 
 /* Map the LinkSection that backs a write_vaddr to an MSec, then to the
  * underlying byte buffer. */
 static u8* patch_ptr(MCtx* x, LinkImage* img, const LinkRelocApply* r,
                      MSec** out_msec) {
   /* Look up via the LinkSection.  After shift_sections the section
    * vaddr is the Mach-O vaddr; the corresponding MSec backs it. */
   if (r->link_section_id == LINK_SEC_NONE) return NULL;
   LinkSection* ls = &img->sections[r->link_section_id - 1u];
   /* MSec by link_sec_id via the prebuilt index (O(1)); fall back to a scan if
    * the index was not built (it always is, post plan_layout). */
   MSec* m = NULL;
   if (x->by_link_sec && ls->id < x->by_link_sec_cap) {
     m = x->by_link_sec[ls->id];
   } else {
     for (u32 i = 0; i < x->nsecs; ++i) {
       if (x->secs[i].link_sec_id == ls->id) {
         m = &x->secs[i];
         break;
       }
     }
   }
   if (!m) return NULL;
   /* The LinkSegment's bytes are valid (not shifted), but the offset
    * within them is the original input_offset.  Use input_offset for
    * the byte offset, since the LinkSegment buffer wasn't reshuffled. */
   /* link_layout.c set ls->file_offset = seg.file_offset + input_offset
    * originally.  ls->vaddr similarly.  After our shift, they're new.
    * The byte offset within the segment buffer is still input_offset. */
   u8* base = bytes_for_section(x, m, img);
   if (!base) return NULL;
   u32 within_section = (u32)(r->write_vaddr - m->vaddr);
   /* The segment buffer's first byte corresponds to ls->input_offset==0
    * for the FIRST section in the segment.  But that's a complication.
    * For simplicity we recompute the segment-relative byte offset by
    * (file_offset - segment.file_offset) where segment.file_offset is
    * unchanged.  Wait: the original layout produced `ls->file_offset =
    * seg.file_offset + input_offset`, and we may have changed
    * ls->file_offset.  Let's just use input_offset stored on the
    * LinkSection. */
   u32 in_off = (u32)(ls->input_offset + within_section);
   if (out_msec) *out_msec = m;
   return base + in_off;
 }
 
 /* Symbol-relative resolved-address S, accounting for imports. */
 static int sym_S(MCtx* x, LinkImage* img, LinkSymId id, u64* out_S,
                  int* out_imp_idx) {
   *out_S = 0;
   *out_imp_idx = 0;
   if (id == LINK_SYM_NONE) return 0;
   LinkSymbol* s = sym_at(img, id);
   if (!s) return 0;
   /* Look up the import index — real imports plus internal-GOT entries
    * the collect_imports pass materialized for GOT-routed internal refs. */
   u32 idx = 0;
   if (id < x->sym_to_imp_size) idx = x->sym_to_imp[id];
   if (!idx && s->name != 0) {
     LinkSymId canon = symhash_get(&img->globals, s->name);
     if (canon != LINK_SYM_NONE && canon < x->sym_to_imp_size)
       idx = x->sym_to_imp[canon];
   }
   if (s->imported) {
     *out_imp_idx = (int)idx;
     return 1;
   }
   /* Internal symbol that has a GOT slot — surface the import index so
    * the GOT_LOAD reloc paths in apply_relocs find it, but also expose
    * S=vaddr so non-GOT relocs (CALL26 etc.) still apply directly. */
   *out_imp_idx = (int)idx;
   *out_S = s->vaddr;
   return 0;
 }
 
 static void apply_relocs(MCtx* x, FixList* fl) {
   LinkImage* img = x->img;
   for (u32 i = 0; i < LinkRelocs_count(&img->relocs); ++i) {
     LinkRelocApply* r = LinkRelocs_at(&img->relocs, i);
     if (r->target == LINK_SYM_NONE) continue;
     /* File-only .debug_* section: patch the registry buffer in place (no
      * __got/stub/chained-fixup — debug bytes aren't loaded or slid). A
      * SK_SECTION target resolves to its DWARF-section-relative base; a
      * code/data symbol to its final (absolute) vaddr for low_pc. Mach-O
      * vaddrs are already absolute, so there's no extra image base. */
     {
       const LinkSection* sec = &img->sections[r->link_section_id - 1u];
       if (sec->file_only) {
         u8* dbg = link_fileonly_bytes(img, r->link_section_id);
         const LinkSymbol* tgt = sym_at(img, r->target);
         if (dbg && tgt)
           link_reloc_apply(x->c, r->kind, dbg + r->offset, tgt->vaddr,
                            r->addend, 0);
         continue;
       }
     }
     MSec* msec = NULL;
     u8* P_bytes = patch_ptr(x, img, r, &msec);
     if (!P_bytes) continue;
     u64 P = r->write_vaddr;
 
     u64 S;
     int imp_idx;
     int is_imp = sym_S(x, img, r->target, &S, &imp_idx);
 
     /* TLVP relocs route through a __thread_ptrs slot regardless of
      * whether the descriptor target is in-image or imported.  Resolved
      * before the import / internal split because an imported TLV
      * descriptor doesn't use the __got slot (its address lives in
      * __thread_ptrs with its own chained bind). */
     if (reloc_kind_is_tlvp(x->c, r->kind)) {
       u32 tlv_idx =
           (r->target < x->sym_to_tlv_size) ? x->sym_to_tlv[r->target] : 0u;
       if (!tlv_idx)
         compiler_panic(x->c, SRCLOC_NONE,
                        "link_macho: TLVP reloc has no __thread_ptrs slot");
       u64 slot_v = x->tlv_ptrs_vaddr + (tlv_idx - 1u) * MZ_TLVP_SIZE;
       link_reloc_apply(x->c, r->kind, P_bytes, slot_v, r->addend, P);
       continue;
     }
 
     if (is_imp) {
       MachImp* mi = (imp_idx > 0) ? &x->imports[imp_idx - 1] : NULL;
       if (reloc_kind_is_branch(x->c, r->kind)) {
         if (!mi || !mi->stub_idx)
           compiler_panic(x->c, SRCLOC_NONE,
                          "link_macho: import has no stub for branch");
         u64 stub_v = x->stubs_vaddr + (mi->stub_idx - 1u) * x->macho->stub_size;
         link_reloc_apply(x->c, r->kind, P_bytes, stub_v, r->addend, P);
         continue;
       }
       if (reloc_kind_is_got_load(x->c, r->kind)) {
         if (!mi)
           compiler_panic(x->c, SRCLOC_NONE,
                          "link_macho: GOT reloc for unknown import");
         u64 got_v = x->got_vaddr + (mi->got_idx - 1u) * MZ_GOT_SIZE;
         link_reloc_apply(x->c, r->kind, P_bytes, got_v, r->addend, P);
         continue;
       }
       if (reloc_kind_is_direct_page(x->c, r->kind)) {
         /* Direct page/lo12 against an import: route through __got. */
         if (!mi)
           compiler_panic(x->c, SRCLOC_NONE,
                          "link_macho: PAGE/LO12 against unknown import");
         u64 got_v = x->got_vaddr + (mi->got_idx - 1u) * MZ_GOT_SIZE;
         link_reloc_apply(x->c, r->kind, P_bytes, got_v, r->addend, P);
         continue;
       }
       if (r->kind == R_ABS64) {
         /* Direct 8-byte absolute against an import: bind the slot. */
         wr_u64_le(P_bytes, 0);
         FixSite fs = {(u8)msec->segidx, 1, {0}, (u32)imp_idx, P, 0};
         fix_push(fl, &fs);
         continue;
       }
       compiler_panic(x->c, SRCLOC_NONE,
                      "link_macho: unhandled reloc kind %u against imported "
                      "symbol",
                      (u32)r->kind);
     }
 
     /* Internal relocs. */
     if (r->kind == R_ABS64) {
       /* Special case: ABS64 reloc inside a TLV descriptor record
        * (__thread_vars section) targeting in-image TLS storage.  This
        * is the descriptor's word-2 "offset" field — dyld interprets it
        * as the per-thread offset of the storage within the TLS image,
        * NOT as an absolute address.  Apple's ld writes the literal
        * offset and emits no chained-fixup entry; replicate that so the
        * chain skips over this slot (chained_fixups already does the
        * right thing: no fixsite -> no chain link). */
       if (msec && (msec->flags & SECTION_TYPE) == S_THREAD_LOCAL_VARIABLES &&
           x->has_tls_image) {
         u64 offset = (S + (u64)r->addend) - x->tls_image_vaddr;
         wr_u64_le(P_bytes, offset);
         continue;
       }
       /* Rebase site. */
       wr_u64_le(P_bytes, S + (u64)r->addend);
       FixSite fs = {(u8)msec->segidx, 0, {0}, 0, P, S + (u64)r->addend};
       fix_push(fl, &fs);
       continue;
     }
     /* Internal symbol routed through __got (clang emits GOT_LOAD_PAGE21
      * for any extern global, even if the def is in-image).  imp_idx
      * was populated by collect_imports' internal-GOT pass; redirect
      * the page/lo12 reloc to the GOT slot's vaddr. */
     if (imp_idx > 0 && reloc_kind_is_got_load(x->c, r->kind)) {
       MachImp* mi = &x->imports[imp_idx - 1];
       u64 got_v = x->got_vaddr + (mi->got_idx - 1u) * MZ_GOT_SIZE;
       link_reloc_apply(x->c, r->kind, P_bytes, got_v, r->addend, P);
       continue;
     }
     /* Generic apply. */
     link_reloc_apply(x->c, r->kind, P_bytes, S, r->addend, P);
   }
 
   /* Per-slot chained fixup.  Real imports → bind (dyld resolves at
    * load).  Internal GOT entries → rebase pointing at the symbol's
    * image-relative vaddr; a target vaddr of 0 (weak undef → NULL) gets
    * no fixup, just a literal zero slot — chained fixups treat 0 as a
    * gap and won't disturb it. */
   for (u32 i = 0; i < x->nimports; ++i) {
     MachImp* mi = &x->imports[i];
     u64 slot_v = x->got_vaddr + (mi->got_idx - 1u) * MZ_GOT_SIZE;
     if (mi->internal) {
       /* Re-read the symbol's final vaddr now that shift_sections has
        * rebased every defined symbol into the Mach-O image layout
        * (collect_imports snapshotted too early). */
       LinkSymbol* s = sym_at(img, mi->sym);
       u64 tgt_v = s ? s->vaddr : 0;
       u8* slot = x->got_bytes + (mi->got_idx - 1u) * MZ_GOT_SIZE;
       wr_u64_le(slot, tgt_v);
       if (tgt_v == 0) continue; /* weak-undef → NULL */
       FixSite fs = {2u, 0, {0}, 0, slot_v, tgt_v};
       fix_push(fl, &fs);
     } else {
       /* clear slot bytes (already zero) — dyld writes via chain */
       FixSite fs = {2u, 1, {0}, i + 1u, slot_v, 0};
       fix_push(fl, &fs);
     }
   }
 
   /* Per-slot TLV pointer fixups.  Mirror of the __got loop above: each
    * __thread_ptrs slot points at the descriptor record.  When the
    * descriptor is in-image (internal) we REBASE to its final vaddr; when
    * it lives in a dylib we BIND through the descriptor's MachImp.  The
    * slot itself lives in __DATA (segidx=3), distinct from __got's
    * __DATA_CONST (segidx=2). */
   for (u32 i = 0; i < x->ntlv; ++i) {
     MachTlv* ts = &x->tlv_slots[i];
     u64 slot_v = x->tlv_ptrs_vaddr + (ts->tlv_idx - 1u) * MZ_TLVP_SIZE;
     u8* slot = x->tlv_ptrs_bytes + (ts->tlv_idx - 1u) * MZ_TLVP_SIZE;
     if (ts->imported) {
       if (!ts->import_idx)
         compiler_panic(x->c, SRCLOC_NONE,
                        "link_macho: imported TLV without matching import slot");
       wr_u64_le(slot, 0);
       FixSite fs = {3u, 1, {0}, ts->import_idx, slot_v, 0};
       fix_push(fl, &fs);
     } else {
       LinkSymbol* s = sym_at(img, ts->sym);
       u64 tgt_v = s ? s->vaddr : 0;
       wr_u64_le(slot, tgt_v);
       if (tgt_v == 0) continue; /* weak-undef descriptor → NULL */
       FixSite fs = {3u, 0, {0}, 0, slot_v, tgt_v};
       fix_push(fl, &fs);
     }
   }
 }
 
 /* ---- chained fixups blob assembler ----
  *
  * For each segment that has fixups, build a dyld_chained_starts_in_segment
  * with one chain per page (MZ_PAGE).  Within a page, sort sites by
  * offset, encode each as DYLD_CHAINED_PTR_64, and link via the `next`
  * field (4-byte units, 0 = end of chain).
  */
 
 static int site_cmp_by_vaddr(const void* a, const void* b) {
   const FixSite* x = a;
   const FixSite* y = b;
   if (x->vaddr < y->vaddr) return -1;
   if (x->vaddr > y->vaddr) return 1;
   return 0;
 }
 
 /* Map each MCtx segment slot to its index in the emitted LC_SEGMENT_64
  * sequence and return the emitted-segment count.  Empty middle segments
  * (__DATA_CONST / __DWARF with no sections) are omitted from the load
  * commands (see emit_load_command_segment calls), so the emitted order is
  * a compaction of the slot order: PAGEZERO, TEXT, [DATA_CONST], [DATA],
  * [DWARF], LINKEDIT.  Must mirror that emit logic exactly.  dyld indexes
  * dyld_chained_starts_in_image.seg_info_offset[] by this emitted order, so
  * the chained-fixups seg table uses it rather than the raw slot index —
  * indexing by slot leaves a non-emitted hole that x86_64 dyld's
  * applyFixupsGeneric resolves to the wrong segment (SIGBUS at load).
  * Slots that are not emitted get emit_idx[slot] = 0xff. */
 static u32 macho_emit_seg_indices(const MCtx* x, u8 emit_idx[MSEG_COUNT]) {
   u32 n = 0;
   for (u32 i = 0; i < x->nsegs; ++i) {
     int emitted = (i == MSEG_PAGEZERO) || (i == MSEG_LINKEDIT) ||
                   (x->segs[i].nsects > 0);
     emit_idx[i] = emitted ? (u8)n : 0xffu;
     if (emitted) ++n;
   }
   return n;
 }
 
 /* tiny insertion sort to avoid pulling qsort */
 static void sort_sites(FixSite* a, u32 n) {
   for (u32 i = 1; i < n; ++i) {
     FixSite tmp = a[i];
     u32 j = i;
     while (j > 0 && site_cmp_by_vaddr(&a[j - 1], &tmp) > 0) {
       a[j] = a[j - 1];
       --j;
     }
     a[j] = tmp;
   }
 }
 
 static void emit_pointer(u8* slot, int is_bind, u32 ord_or_target_lo,
                          u32 high_or_target_hi, u32 next4) {
   /* DYLD_CHAINED_PTR_64:
    *   bind  : ordinal:24, addend:8, reserved:19, next:12, bind:1=1
    *   rebase: target:36 (vmaddr), high8:8, reserved:7, next:12, bind:1=0
    */
   u64 v = 0;
   if (is_bind) {
     u64 ordinal = (u64)ord_or_target_lo & 0xffffffull; /* 24 bits */
     u64 addend = 0;
     u64 next = (u64)next4 & 0xfffull;
     v = ordinal | (addend << 24) | (0ull /* reserved */ << 32) | (next << 51) |
         ((u64)1 << 63);
   } else {
     /* rebase: target is full vmaddr; we get hi:lo split. */
     u64 target = ((u64)high_or_target_hi << 32) | (u64)ord_or_target_lo;
     target &= ((u64)1 << 36) - 1u; /* 36 bits */
     u64 high8 = 0;
     u64 next = (u64)next4 & 0xfffull;
     v = target | (high8 << 36) | (0ull /* reserved */ << 44) | (next << 51) |
         ((u64)0 << 63);
   }
   wr_u64_le(slot, v);
 }
 
 static void build_chained_fixups(MCtx* x, FixList* fl) {
   Heap* h = x->h;
   ObjByteBuf* out = &x->chained_fixups;
   objbb_init(out, h);
 
   /* Header (32 B):
    *   uint32 fixups_version (=0)
    *   uint32 starts_offset
    *   uint32 imports_offset
    *   uint32 symbols_offset
    *   uint32 imports_count
    *   uint32 imports_format (=1)
    *   uint32 symbols_format (=0)
    */
   u32 hdr_pos = objbb_u32(out, 0); /* fixups_version */
   (void)hdr_pos;
   u32 starts_offset_pos = objbb_u32(out, 0);
   u32 imports_offset_pos = objbb_u32(out, 0);
   u32 symbols_offset_pos = objbb_u32(out, 0);
   objbb_u32(out, x->nimports_real);
   objbb_u32(out, DYLD_CHAINED_IMPORT);
   objbb_u32(out, 0); /* symbols uncompressed */
   /* dyld expects 8-byte alignment of the starts table. */
   objbb_align(out, 4);
 
   /* dyld_chained_starts_in_image:
    *   uint32 seg_count
    *   uint32 seg_info_offset[seg_count]
    *
    * seg_count must equal mach-O segment count (5).
    * seg_info_offset[i] = 0 means no fixups in that segment.
    */
   u32 starts_off = out->len;
   wr_u32_le(out->data + starts_offset_pos, starts_off);
   /* seg_count + seg_info_offset[] are indexed by emitted LC_SEGMENT_64
    * order, not MCtx slot — empty middle segments are dropped from the load
    * commands. */
   u8 emit_seg[MSEG_COUNT];
   u32 emit_nsegs = macho_emit_seg_indices(x, emit_seg);
   objbb_u32(out, emit_nsegs);
   /* Reserve seg_info_offset[]. */
   u32 seg_info_offsets_pos = out->len;
   for (u32 i = 0; i < emit_nsegs; ++i) objbb_u32(out, 0);
 
   /* Sort fixsites by vaddr globally. */
   sort_sites(fl->a, fl->n);
 
   /* Per segment, emit dyld_chained_starts_in_segment when fixups present. */
   for (u32 si = 0; si < x->nsegs; ++si) {
     /* count sites in this segment */
     u32 first = (u32)-1, count = 0;
     for (u32 k = 0; k < fl->n; ++k) {
       if (fl->a[k].segidx == si) {
         if (first == (u32)-1) first = k;
         ++count;
       }
     }
     if (!count) continue;
     if (emit_seg[si] == 0xffu)
       compiler_panic(x->c, SRCLOC_NONE,
                      "link_macho: chained fixups in non-emitted segment %u",
                      (unsigned)si);
     /* Page-align this struct to 4. */
     objbb_align(out, 4);
     u32 sis_off = out->len;
     /* Patch seg_info_offset[emitted index] to (sis_off - starts_off). */
     wr_u32_le(out->data + seg_info_offsets_pos + emit_seg[si] * 4u,
               sis_off - starts_off);
 
     /* Compute page count for this segment. */
     u64 seg_va = x->segs[si].vmaddr;
     u64 seg_size = x->segs[si].vmsize ? x->segs[si].vmsize : MZ_PAGE;
     u32 page_count = (u32)((seg_size + MZ_PAGE - 1u) / MZ_PAGE);
 
     /* dyld_chained_starts_in_segment:
      *   uint32 size
      *   uint16 page_size
      *   uint16 pointer_format
      *   uint64 segment_offset    (offset of segment's first byte from
      *                             mach_header)
      *   uint32 max_valid_pointer (0 for 64-bit)
      *   uint16 page_count
      *   uint16 page_start[page_count]  (0xFFFF = no fixups in page)
      */
     u32 sis_size_pos = objbb_u32(out, 0); /* fill below */
     objbb_u16(out, (u16)MZ_PAGE);
     objbb_u16(out, (u16)DYLD_CHAINED_PTR_64);
     objbb_u64(out, (u64)x->segs[si].fileoff); /* segment file offset */
     objbb_u32(out, 0);
     objbb_u16(out, (u16)page_count);
     u32 page_starts_pos = out->len;
     for (u32 p = 0; p < page_count; ++p) objbb_u16(out, 0xFFFFu);
     /* size includes the page_start array */
     u32 sis_size = out->len - sis_size_pos + 4u;
     /* Hmm, the `size` field is the size of *this* struct. We measure
      * from sis_off through end of page_starts. */
     sis_size = out->len - sis_off;
     wr_u32_le(out->data + sis_size_pos, sis_size);
 
     /* Now: walk sites in this segment, group by page, write
      * page_start[i] = offset_in_page of first site, and chain via
      * next-field in the actual segment's bytes. */
     /* Sites are sorted globally; collect contiguous run for this seg. */
     u32 cur = first;
     while (cur < first + count) {
       u32 page_idx = (u32)((fl->a[cur].vaddr - seg_va) / MZ_PAGE);
       u32 offset_in_page = (u32)((fl->a[cur].vaddr - seg_va) % MZ_PAGE);
       wr_u16_le(out->data + page_starts_pos + page_idx * 2u,
                 (u16)offset_in_page);
       /* Walk this page's chain. */
       u32 next_in_page = cur;
       while (next_in_page + 1 < first + count) {
         u64 nv = fl->a[next_in_page + 1].vaddr;
         if (nv >= seg_va + (u64)(page_idx + 1) * MZ_PAGE) break;
         ++next_in_page;
       }
       /* Encode chain pointers. */
       for (u32 k = cur; k <= next_in_page; ++k) {
         FixSite* s = &fl->a[k];
         u32 next4 = 0;
         if (k < next_in_page) {
           u64 dist = fl->a[k + 1].vaddr - s->vaddr;
           next4 = (u32)(dist / 4u);
         }
         /* Find segment bytes.  Synthetic pointer sections have private
          * buffers; file-backed sections can live in any segment, including
          * pointer-bearing read-only constants in __TEXT. */
         u8* slot = NULL;
         if (s->segidx == 2 && x->got_bytes && s->vaddr >= x->got_vaddr &&
             s->vaddr < x->got_vaddr + x->got_size) {
           /* __DATA_CONST: __got slot. */
           slot = x->got_bytes + (s->vaddr - x->got_vaddr);
         } else if (x->tlv_ptrs_bytes && s->vaddr >= x->tlv_ptrs_vaddr &&
                    s->vaddr < x->tlv_ptrs_vaddr + x->tlv_ptrs_size) {
           slot = x->tlv_ptrs_bytes + (s->vaddr - x->tlv_ptrs_vaddr);
         } else {
           MSec* m = msec_for_vaddr(x, s->vaddr);
           if (m && m->link_sec_id) {
             u8* base = bytes_for_section(x, m, x->img);
             if (base) {
               LinkSection* ls = &x->img->sections[m->link_sec_id - 1u];
               u32 in_off = (u32)(ls->input_offset + (s->vaddr - m->vaddr));
               slot = base + in_off;
             }
           }
         }
         if (!slot)
           compiler_panic(x->c, SRCLOC_NONE,
                          "link_macho: chained-fixup slot for vaddr 0x%llx not "
                          "in any segment buffer",
                          (unsigned long long)s->vaddr);
         if (s->is_bind) {
           /* ordinal is import index (1-based) - 1; chained-import format
            * uses 0-based. */
           if (s->import_idx == 0 || s->import_idx > x->nimports_real) {
             compiler_panic(
                 x->c, SRCLOC_NONE,
                 "link_macho: chained bind for vaddr 0x%llx uses import index "
                 "%u outside real import table size %u",
                 (unsigned long long)s->vaddr, (unsigned)s->import_idx,
                 (unsigned)x->nimports_real);
           }
           u32 ord = s->import_idx - 1u;
           emit_pointer(slot, 1, ord, 0, next4);
         } else {
           /* rebase target = unslid vmaddr */
           u32 lo = (u32)(s->rebase_target & 0xffffffffu);
           u32 hi = (u32)(s->rebase_target >> 32);
           emit_pointer(slot, 0, lo, hi, next4);
         }
       }
       cur = next_in_page + 1u;
     }
   }
 
   /* Imports table: one dyld_chained_import (4B) per real import.
    * Layout: lib_ordinal:8, weak:1, name_offset:23.  Internal-GOT
    * entries are not bound by dyld so they're omitted here. */
   objbb_align(out, 4);
   u32 imports_off = out->len;
   wr_u32_le(out->data + imports_offset_pos, imports_off);
   /* We need to first build the symbol pool to know name offsets. */
   u32 symbols_off = imports_off + x->nimports_real * 4u;
   /* Reserve imports area. */
   for (u32 i = 0; i < x->nimports_real; ++i) objbb_u32(out, 0);
   /* Emit symbols (each NUL-terminated). Set name_offset on each import. */
   wr_u32_le(out->data + symbols_offset_pos, out->len);
   /* Leading NUL for offset 0. */
   objbb_u8(out, 0);
   for (u32 i = 0; i < x->nimports_real; ++i) {
     MachImp* mi = &x->imports[i];
     Slice nm_s = pool_slice(x->c->global, mi->name);
     const char* nm = nm_s.s;
     size_t nl = nm_s.len;
     if (!nm || !nl || mi->dylib_ord == 0 || mi->dylib_ord > x->ndylibs) {
       compiler_panic(x->c, SRCLOC_NONE,
                      "link_macho: invalid chained import %u "
                      "(name=%u dylib_ord=%u ndylibs=%u)",
                      (unsigned)i, (unsigned)mi->name, (unsigned)mi->dylib_ord,
                      (unsigned)x->ndylibs);
     }
     u32 off = out->len - symbols_off;
     objbb_str(out, nm, (u32)nl);
     /* Patch the import slot. */
     u32 packed = ((u32)mi->dylib_ord & 0xffu) |
                  ((u32)(mi->weak ? 1u : 0u) << 8) | ((off & 0x7fffffu) << 9);
     wr_u32_le(out->data + imports_off + i * 4u, packed);
   }
   (void)symbols_off;
 }
 
 /* ---- exports trie ---- *
  *
  * Minimal trie: one node carrying a single export "_main" with the
  * entry symbol's VA-relative offset.  This is enough for dyld; binaries
  * with a real exports trie include more data but we don't need it. */
 
 static void uleb128(ObjByteBuf* out, u64 v) {
   do {
     u8 byte = v & 0x7fu;
     v >>= 7;
     if (v) byte |= 0x80u;
     objbb_u8(out, byte);
   } while (v);
 }
 
 static u32 uleb128_size(u64 v) {
   u32 n = 0;
   do {
     ++n;
     v >>= 7;
   } while (v);
   return n;
 }
 
 static void build_exports_trie(MCtx* x) {
   /* Format:
    *   node = (terminal_size: uleb128) (export_data)? (children_count: u8)
    *          (children: [(label NUL) (offset uleb128)]*)
    *
    * We emit a trie with a single leaf at "_main" with offset
    * entry_offset (from __TEXT base).
    *
    * Easiest: single root node with children_count=1, child label = "_main",
    * child offset points to a leaf node.
    */
   ObjByteBuf* out = &x->exports_trie;
   objbb_init(out, x->h);
 
   LinkImage* img = x->img;
   LinkSymbol* esym = sym_at(img, img->entry_sym);
   if (!esym || !esym->defined) {
     /* No entry — emit a single empty terminal trie. */
     objbb_u8(out, 0); /* terminal_size 0 */
     objbb_u8(out, 0); /* children 0 */
     return;
   }
   Slice nm_s = pool_slice(x->c->global, esym->name);
   const char* nm = nm_s.s;
   size_t nl = nm_s.len;
   if (!nm || nl == 0) {
     objbb_u8(out, 0);
     objbb_u8(out, 0);
     return;
   }
   /* leaf node: terminal_size = sizeof(uleb(flags)+uleb(offset))
    * flags = 0 (regular export); offset = vaddr - __TEXT.vmaddr */
   u64 entry_off = esym->vaddr - x->text_vaddr;
 
   /* Compute leaf-node bytes length: uleb(flags=0) + uleb(offset). */
   u32 flags = 0;
   u32 leaf_payload_len = uleb128_size(flags) + uleb128_size(entry_off);
   /* Layout: root node first, then leaf.  The root node's child entry
    * carries the absolute offset of the leaf within the trie. */
 
   /* root: terminal_size=0, children_count=1, "_main"\0, child_offset=
    *        (leaf-position uleb).
    *
    * The child offset's own ULEB width contributes to the leaf position, so
    * solve for the fixed point before emitting. */
   u32 leaf_pos = 2u + (u32)nl + 1u + 1u;
   for (;;) {
     u32 n = uleb128_size(leaf_pos);
     u32 next = 2u + (u32)nl + 1u + n;
     if (next == leaf_pos) break;
     leaf_pos = next;
   }
 
   objbb_u8(out, 0); /* root terminal size */
   objbb_u8(out, 1); /* children_count */
   objbb_str(out, nm, (u32)nl);
   uleb128(out, leaf_pos);
   /* leaf node */
   if (out->len != leaf_pos)
     compiler_panic(x->c, SRCLOC_NONE,
                    "macho: exports trie leaf offset mismatch");
   /* terminal_size byte then payload */
   objbb_u8(out, (u8)leaf_payload_len);
   uleb128(out, flags);
   uleb128(out, entry_off);
   objbb_u8(out, 0); /* children_count */
   /* Pad trie to 8 bytes. */
   objbb_align(out, 8);
 }
 
 /* ---- symtab + strtab + indirect symtab ---- */
 
 typedef struct NlistRec {
   u32 strx;
   u8 type;
   u8 sect; /* 1-based section index (Mach-O) */
   u16 desc;
   u64 value;
 } NlistRec;
 
 static void build_symtab(MCtx* x) {
   Heap* h = x->h;
   LinkImage* img = x->img;
   objbb_init(&x->symtab, h);
   objbb_init(&x->strtab, h);
   objbb_init(&x->indirect, h);
 
   /* strtab leading NUL */
   objbb_u8(&x->strtab, 0);
 
   /* Approach:
    * - Add one local nlist per defined LinkSymbol (locals + non-imported
    *   externs) — but to keep things simple we only emit external defined
    *   syms (mainly _main), plus all imports as N_UNDF|N_EXT.
    *
    * Mach-O dyld requires the symtab order: locals first, ext-defs next,
    * undef last (matched by LC_DYSYMTAB ranges).
    */
 
   /* Pass A: defined externals. */
   u32 n_local = 0;
   u32 n_extdef = 0;
   u32 n_undef = 0;
 
   /* For now we emit only externals + imports.  No locals. */
   /* extdef pass */
   for (u32 i = 0; i < LinkSyms_count(&img->syms); ++i) {
     LinkSymbol* s = LinkSyms_at(&img->syms, i);
     if (!s->defined) continue;
     if (s->bind != SB_GLOBAL && s->bind != SB_WEAK) continue;
     if (s->name == 0) continue;
     if (!link_symbol_is_canonical_global(img, s)) continue;
     if (s->kind == SK_ABS) continue; /* skip abs externs */
     /* Locate which OutSec contains this vaddr to figure out n_sect.
      * n_sect is the 1-based index into the flat section_64 table the
      * file actually contains (post-coalesce), matching what we emit
      * in emit_load_command_segment. */
     u8 n_sect = 0;
     /* Prefer the section whose half-open [vaddr, vaddr+size) range contains
      * the symbol. This must win over the end-boundary fallback below: when
      * two sections abut (A ends exactly where B begins), a symbol at the
      * boundary is the *start* of B, not the end of A. */
     for (u32 k = 0; k < x->nouts; ++k) {
       OutSec* o = &x->outs[k];
       if (s->vaddr >= o->vaddr && s->vaddr < o->vaddr + o->size) {
         n_sect = (u8)(k + 1u);
         break;
       }
     }
     /* Fallback: a symbol sitting exactly one-past-the-end of a section with
      * no following section covering it (e.g. an end-of-section marker) is
      * attributed to the section that ends there. */
     if (n_sect == 0) {
       for (u32 k = 0; k < x->nouts; ++k) {
         OutSec* o = &x->outs[k];
         if (s->vaddr == o->vaddr + o->size) {
           n_sect = (u8)(k + 1u);
           break;
         }
       }
     }
     if (n_sect == 0) continue;
     Slice nm_s = pool_slice(x->c->global, s->name);
     const char* nm = nm_s.s;
     size_t nl = nm_s.len;
     u32 strx = x->strtab.len;
     if (nm && nl) objbb_str(&x->strtab, nm, (u32)nl);
 
     u8 t[16];
     u8 nt = N_SECT | N_EXT;
     if (s->bind == SB_WEAK) {
       /* N_WEAK_DEF in n_desc (not a flag in n_type) */
     }
     wr_u32_le(t + 0, strx);
     t[4] = nt;
     t[5] = n_sect;
     wr_u16_le(t + 6, s->bind == SB_WEAK ? N_WEAK_DEF : 0);
     wr_u64_le(t + 8, s->vaddr);
     objbb_append(&x->symtab, t, 16);
     ++n_extdef;
   }
 
   /* undef imports — real imports only.  Internal-GOT entries don't get
    * N_UNDF nlist records since they're defined in the image. */
   u32 imp_first_symtab_idx = n_extdef;
   for (u32 i = 0; i < x->nimports_real; ++i) {
     MachImp* mi = &x->imports[i];
     Slice nm_s = pool_slice(x->c->global, mi->name);
     const char* nm = nm_s.s;
     size_t nl = nm_s.len;
     u32 strx = x->strtab.len;
     if (nm && nl) objbb_str(&x->strtab, nm, (u32)nl);
 
     u8 t[16];
     wr_u32_le(t + 0, strx);
     t[4] = N_UNDF | N_EXT;
     t[5] = 0;
     /* n_desc carries dylib ordinal in high byte (REFERENCED_DYNAMICALLY etc.)
      */
     u16 desc = (u16)(((u16)mi->dylib_ord & 0xff) << 8);
     if (mi->weak) desc |= N_WEAK_REF;
     wr_u16_le(t + 6, desc);
     wr_u64_le(t + 8, 0);
     objbb_append(&x->symtab, t, 16);
     ++n_undef;
   }
 
   /* indirect symtab: one entry per __stubs slot, then one per __got
    * slot.  Internal-GOT slots use INDIRECT_SYMBOL_LOCAL (0x80000000)
    * since they have no nlist entry. */
   u32 indirect_start = 0;
   /* Patch reserved1 of each synth OutSec.  __stubs and __got are each
    * singleton OutSecs (synth sections never coalesce with user input),
    * so a sectname match identifies them unambiguously. */
   for (u32 i = 0; i < x->nouts; ++i) {
     OutSec* o = &x->outs[i];
     if (slice_eq_cstr(slice_from_cstr(o->sectname), "__stubs") && o->size) {
       o->reserved1 = indirect_start;
       for (u32 k = 0; k < x->nimports; ++k) {
         MachImp* mi = &x->imports[k];
         if (!mi->stub_idx) continue;
         u32 sym_idx = imp_first_symtab_idx + k;
         objbb_u32(&x->indirect, sym_idx);
         ++indirect_start;
       }
     }
   }
   for (u32 i = 0; i < x->nouts; ++i) {
     OutSec* o = &x->outs[i];
     if (slice_eq_cstr(slice_from_cstr(o->sectname), "__got") && o->size) {
       o->reserved1 = indirect_start;
       for (u32 k = 0; k < x->nimports; ++k) {
         MachImp* mi = &x->imports[k];
         u32 sym_idx = mi->internal ? 0x80000000u /* INDIRECT_SYMBOL_LOCAL */
                                    : (imp_first_symtab_idx + k);
         objbb_u32(&x->indirect, sym_idx);
         ++indirect_start;
       }
     }
   }
 
   x->nsyms = n_local + n_extdef + n_undef;
   (void)n_local;
   (void)imp_first_symtab_idx;
 }
 
 /* ---- LINKEDIT layout assembly ----
  *
  * Place blobs in the order Apple prefers:
  *   chained_fixups, exports_trie, fn_starts, data_in_code,
  *   symtab, indirect, strtab, codesig
  */
 
 static void layout_linkedit(MCtx* x) {
   /* LC_FUNCTION_STARTS is a ULEB128 stream terminated by a zero byte.  Keep a
    * real empty table here so tools that rewrite LINKEDIT preserve the
    * canonical blob order between exports and the symbol table. */
   objbb_init(&x->fn_starts, x->h);
   objbb_u8(&x->fn_starts, 0);
   objbb_init(&x->data_in_code, x->h);
   objbb_init(&x->codesig, x->h);
 
   u64 cur = x->linkedit_fileoff;
   /* chained fixups */
   cur = ALIGN_UP(cur, 8u);
   x->chained_fixups_off = (u32)cur;
   cur += x->chained_fixups.len;
   /* exports trie. Keep LINKEDIT data blobs contiguous; Apple strip rejects
    * padding between chained fixups and the exports trie. */
   x->exports_trie_off = (u32)cur;
   cur += x->exports_trie.len;
   /* function starts */
   x->fn_starts_off = (u32)cur;
   cur += x->fn_starts.len;
   /* data in code */
   cur = ALIGN_UP(cur, 8u);
   x->data_in_code_off = (u32)cur;
   /* symtab */
   cur = ALIGN_UP(cur, 8u);
   x->symtab_off = (u32)cur;
   cur += x->symtab.len;
   /* indirect symtab */
   cur = ALIGN_UP(cur, 4u);
   x->indirect_off = (u32)cur;
   cur += x->indirect.len;
   /* strtab */
   cur = ALIGN_UP(cur, 8u);
   x->strtab_off = (u32)cur;
   cur += x->strtab.len;
   /* code signature: end-aligned to 16 */
   cur = ALIGN_UP(cur, 16u);
   x->codesig_off = (u32)cur;
 
   /* Linkedit segment file_size includes everything up to (but not yet
    * including) codesig.  Codesig is computed below. */
   u64 le_size = cur - x->linkedit_fileoff;
   /* Set linkedit segment size; will be increased after codesig. */
   x->segs[MSEG_LINKEDIT].filesize = le_size;
   x->segs[MSEG_LINKEDIT].vmsize = ALIGN_UP(le_size, MZ_PAGE);
   if (!x->segs[MSEG_LINKEDIT].vmsize) x->segs[MSEG_LINKEDIT].vmsize = MZ_PAGE;
 }
 
 /* ---- ad-hoc code signature (CodeDirectory + SuperBlob) ----
  *
  * Produces a minimal embedded SuperBlob with a single CodeDirectory.
  * The CD is sha256-hashed over CS_PAGE_SIZE_LOG2 = 4096-byte pages of
  * the file (excluding the codesig itself).  The kernel verifies the
  * CD's hash chain on exec.
  *
  * Output format (in big-endian for SuperBlob/CodeDirectory headers):
  *   [SuperBlob]
  *     u32 magic    (0xfade0cc0)
  *     u32 length
  *     u32 count    (=1)
  *     [Slot]
  *       u32 type (=0 CSSLOT_CODEDIRECTORY)
  *       u32 offset (=20)  -- relative to start of SuperBlob
  *   [CodeDirectory]
  *     u32 magic    (0xfade0c02)
  *     u32 length   (bytes including all hashes)
  *     u32 version  (>=0x20400 for execSeg fields)
  *     u32 flags    (=0 ad-hoc — actually flags must include 0x2
  * (kSecCodeSignatureAdhoc)) u32 hashOffset  (offset of first slot hash) u32
  * identOffset (offset of identifier string) u32 nSpecialSlots (=0) u32
  * nCodeSlots u32 codeLimit  (file bytes covered) u8  hashSize   (=32) u8
  * hashType   (=2 sha256) u8  platform   (=0) u8  pageSize   (=12 for 4096) u32
  * spare2     (=0) u32 scatterOffset (=0) u32 teamOffset    (=0) u32 spare3 (=0)
  *     u64 codeLimit64   (=0)
  *     u64 execSegBase   (=__TEXT.fileoff)
  *     u64 execSegLimit  (=__TEXT.filesize)
  *     u64 execSegFlags  (=1 main binary)
  *     [identifier bytes "a.out\0"]
  *     [codeslot hashes  nCodeSlots * 32 B]
  *
  * Hashes computed AFTER everything else is final — including the codesig
  * blob's own offset in the file (the hash range stops just before
  * codeLimit). */
 
 static void wr_u64_be(u8* p, u64 v) {
   for (u32 i = 0; i < 8; ++i) p[7 - i] = (u8)(v >> (i * 8));
 }
 
 /* Build the codesig blob with placeholder hashes; size is precise so
  * file layout is final after this. */
 static void build_codesig_skeleton(MCtx* x, u32 code_limit, const char* ident) {
   u32 page_log2 = x->cs_page_log2 ? x->cs_page_log2 : CS_PAGE_SIZE_LOG2;
   u32 code_page = 1u << page_log2;
   u32 nslots = (code_limit + code_page - 1u) / code_page;
 
   /* CodeDirectory size:
    *   header 88 bytes through execSegFlags
    *   identifier (ident_len + 1)
    *   hashes (nslots * 32)
    */
   u32 ident_len = (u32)slice_from_cstr(ident).len + 1u;
   u32 cd_hdr = 88u;
   u32 cd_size = cd_hdr + ident_len + nslots * CS_SHA256_LEN;
   /* SuperBlob: 12 hdr + 8 slot + cd. */
   u32 sb_size = 12u + 8u + cd_size;
 
   ObjByteBuf* out = &x->codesig;
   objbb_init(out, x->h);
   objbb_reserve(out, sb_size);
   memset(out->data, 0, sb_size);
   out->len = sb_size;
 
   u8* sb = out->data;
   /* SuperBlob header */
   wr_u32_be(sb + 0, CS_MAGIC_EMBEDDED_SIGNATURE);
   wr_u32_be(sb + 4, sb_size);
   wr_u32_be(sb + 8, 1); /* count */
   /* slot 0: type=CSSLOT_CODEDIRECTORY, offset=20 */
   wr_u32_be(sb + 12, CSSLOT_CODEDIRECTORY);
   wr_u32_be(sb + 16, 20u);
 
   /* CodeDirectory */
   u8* cd = sb + 20;
   wr_u32_be(cd + 0, CS_MAGIC_CODEDIRECTORY);
   wr_u32_be(cd + 4, cd_size);
   wr_u32_be(cd + 8, 0x20400u);            /* version with execSeg */
   wr_u32_be(cd + 12, 0x2u);               /* flags = adhoc */
   wr_u32_be(cd + 16, cd_hdr + ident_len); /* hashOffset */
   wr_u32_be(cd + 20, cd_hdr);             /* identOffset */
   wr_u32_be(cd + 24, 0);                  /* nSpecialSlots */
   wr_u32_be(cd + 28, nslots);
   wr_u32_be(cd + 32, code_limit);
   cd[36] = (u8)CS_SHA256_LEN;
   cd[37] = (u8)CS_HASHTYPE_SHA256;
   cd[38] = 0; /* platform */
   cd[39] = (u8)page_log2;
   wr_u32_be(cd + 40, 0);                   /* spare2 */
   wr_u32_be(cd + 44, 0);                   /* scatterOffset */
   wr_u32_be(cd + 48, 0);                   /* teamOffset */
   wr_u32_be(cd + 52, 0);                   /* spare3 */
   wr_u64_be(cd + 56, 0);                   /* codeLimit64 */
   wr_u64_be(cd + 64, x->segs[1].fileoff);  /* execSegBase */
   wr_u64_be(cd + 72, x->segs[1].filesize); /* execSegLimit */
   wr_u64_be(cd + 80, CS_EXECSEG_MAIN_BINARY);
 
   /* identifier */
   memcpy(cd + cd_hdr, ident, ident_len);
 
   x->codesig_size = sb_size;
 }
 
 static void compute_codesig(MCtx* x, const u8* full_file, u32 file_len_excl_cs,
                             const char* ident) {
   u32 page_log2 = x->cs_page_log2 ? x->cs_page_log2 : CS_PAGE_SIZE_LOG2;
   u32 code_page = 1u << page_log2;
   u32 nslots = (file_len_excl_cs + code_page - 1u) / code_page;
   u32 ident_len = (u32)slice_from_cstr(ident).len + 1u;
   u8* cd = x->codesig.data + 12 + 8;
   u8* hashes = cd + 88u + ident_len;
 
   for (u32 i = 0; i < nslots; ++i) {
     u32 off = i * code_page;
     u32 take = (off + code_page <= file_len_excl_cs) ? code_page
                                                      : (file_len_excl_cs - off);
     Sha256 s;
     sha256_init(&s);
     sha256_update(&s, full_file + off, take);
     /* Pages shorter than code_page get the standard SHA over the
      * partial bytes — Apple's tools do exactly this (no zero padding
      * on the tail). */
     sha256_final(&s, hashes + i * CS_SHA256_LEN);
   }
 }
 
 /* ---- final emission ---- */
 
 static void emit_load_command_segment(ObjByteBuf* lc, MCtx* x, u32 segidx) {
   MSeg* sg = &x->segs[segidx];
   u32 seg_cmd_size = MACHO_SEGCMD64_SIZE + sg->nouts * MACHO_SECT64_SIZE;
   u32 base = lc->len;
   objbb_u32(lc, LC_SEGMENT_64);
   objbb_u32(lc, seg_cmd_size);
   /* segname: 16 bytes zero-padded */
   u8 nm[16];
   memset(nm, 0, 16);
   size_t nlen = slice_from_cstr(sg->name).len;
   if (nlen > 16) nlen = 16;
   memcpy(nm, sg->name, nlen);
   objbb_append(lc, nm, 16);
   objbb_u64(lc, sg->vmaddr);
   objbb_u64(lc, sg->vmsize);
   objbb_u64(lc, sg->fileoff);
   objbb_u64(lc, sg->filesize);
   objbb_u32(lc, sg->maxprot);
   objbb_u32(lc, sg->initprot);
   objbb_u32(lc, sg->nouts);
   objbb_u32(lc, 0); /* flags */
 
   for (u32 j = 0; j < sg->nouts; ++j) {
     OutSec* o = &x->outs[sg->first_out + j];
     u8 sname[16], gname[16];
     memset(sname, 0, 16);
     memset(gname, 0, 16);
     size_t sl = o->sectname ? slice_from_cstr(o->sectname).len : 0;
     if (sl > 16) sl = 16;
     if (sl) memcpy(sname, o->sectname, sl);
     size_t gl = slice_from_cstr(sg->name).len; /* segname must match */
     if (gl > 16) gl = 16;
     memcpy(gname, sg->name, gl);
     objbb_append(lc, sname, 16);
     objbb_append(lc, gname, 16);
     objbb_u64(lc, o->vaddr);
     objbb_u64(lc, o->size);
     objbb_u32(lc, (u32)o->file_offset);
     /* align is power of 2; encode as log2. */
     u32 a = o->align ? o->align : 1u;
     u32 al = 0;
     while ((1u << al) < a) ++al;
     objbb_u32(lc, al);
     objbb_u32(lc, 0); /* reloff */
     objbb_u32(lc, 0); /* nreloc */
     objbb_u32(lc, o->flags);
     objbb_u32(lc, o->reserved1);
     objbb_u32(lc, o->reserved2);
     objbb_u32(lc, 0); /* reserved3 */
   }
   (void)base;
 }
 
 void link_emit_macho(LinkImage* img, Writer* w);
 
 void link_emit_macho(LinkImage* img, Writer* w) {
   MCtx x;
   memset(&x, 0, sizeof(x));
   x.img = img;
   x.c = img->c;
   x.h = img->heap;
   x.w = w;
   x.linker = img->linker;
   x.link_arch = link_arch_desc_for(img->c);
   /* Apple-Silicon arm64 mains must be signed with 16 KiB hash pages (the native
    * VM page); x86_64 uses 4 KiB. See CS_PAGE_SIZE_LOG2. */
   x.cs_page_log2 = (img->c->target.arch == KIT_ARCH_ARM_64) ? 14u : 12u;
   {
     const ObjFormatImpl* fmt = obj_format_lookup(KIT_OBJ_MACHO);
     x.macho =
         fmt && fmt->macho_arch ? fmt->macho_arch(img->c->target.arch) : NULL;
   }
 
   if (!x.link_arch || !x.macho || !x.macho->cputype || !x.macho->emit_stub ||
       !x.macho->stub_size)
     compiler_panic(x.c, SRCLOC_NONE,
                    "link_emit_macho: no Mach-O descriptor for target");
   if (img->entry_sym == LINK_SYM_NONE)
     compiler_panic(x.c, SRCLOC_NONE, "link_emit_macho: no resolved entry");
 
   collect_imports(&x);
   collect_tlv(&x);
   plan_layout(&x);
   build_section_index(&x);
   shift_sections(&x);
 
   /* entry offset within __TEXT segment. */
   LinkSymbol* esym = sym_at(img, img->entry_sym);
   if (!esym || !esym->defined)
     compiler_panic(x.c, SRCLOC_NONE, "link_emit_macho: entry symbol undefined");
   if (esym->vaddr < x.text_vaddr)
     compiler_panic(x.c, SRCLOC_NONE,
                    "link_emit_macho: entry symbol below __TEXT base");
   x.entry_offset = (u32)(esym->vaddr - x.text_vaddr);
 
   /* image-id UUID. */
   u8 image_id[LINK_IMAGE_ID_BYTES];
   link_image_id_compute(img, image_id);
   memcpy(x.uuid, image_id, 16);
 
   /* Reloc apply collects fixsites. */
   FixList fl;
   fix_init(&fl, x.h);
   apply_relocs(&x, &fl);
 
   /* Build LINKEDIT contents. */
   build_chained_fixups(&x, &fl);
   build_exports_trie(&x);
   build_symtab(&x);
   layout_linkedit(&x);
 
   /* Compute code-sig skeleton sized to file bytes excluding sig. */
   u32 code_limit = x.codesig_off;
   build_codesig_skeleton(&x, code_limit, "a.out");
   /* Now extend linkedit segment to include codesig. */
   u64 le_size = (u64)x.codesig_off + (u64)x.codesig_size - x.linkedit_fileoff;
   x.segs[MSEG_LINKEDIT].filesize = le_size;
   x.segs[MSEG_LINKEDIT].vmsize = ALIGN_UP(le_size, MZ_PAGE);
 
   /* Build load commands buffer. */
   ObjByteBuf lc;
   objbb_init(&lc, x.h);
 
   /* LC_SEGMENT_64 for each segment with sections (and PAGEZERO/LINKEDIT). */
   emit_load_command_segment(&lc, &x, 0); /* PAGEZERO */
   emit_load_command_segment(&lc, &x, 1); /* TEXT */
   if (x.segs[2].nsects > 0)
     emit_load_command_segment(&lc, &x, 2); /* DATA_CONST */
   if (x.segs[3].nsects > 0) emit_load_command_segment(&lc, &x, 3); /* DATA */
   if (x.segs[MSEG_DWARF].nsects > 0)
     emit_load_command_segment(&lc, &x, MSEG_DWARF);  /* DWARF (debug info) */
   emit_load_command_segment(&lc, &x, MSEG_LINKEDIT); /* LINKEDIT */
 
   /* LC_DYLD_CHAINED_FIXUPS  (linkedit_data_command: 16B) */
   objbb_u32(&lc, LC_DYLD_CHAINED_FIXUPS);
   objbb_u32(&lc, 16);
   objbb_u32(&lc, x.chained_fixups_off);
   objbb_u32(&lc, x.chained_fixups.len);
 
   /* LC_DYLD_EXPORTS_TRIE */
   objbb_u32(&lc, LC_DYLD_EXPORTS_TRIE);
   objbb_u32(&lc, 16);
   objbb_u32(&lc, x.exports_trie_off);
   objbb_u32(&lc, x.exports_trie.len);
 
   /* LC_SYMTAB */
   objbb_u32(&lc, LC_SYMTAB);
   objbb_u32(&lc, MACHO_SYMTAB_CMD_SIZE);
   objbb_u32(&lc, x.symtab_off);
   objbb_u32(&lc, x.nsyms);
   objbb_u32(&lc, x.strtab_off);
   objbb_u32(&lc, x.strtab.len);
 
   /* LC_DYSYMTAB */
   /* nlocal=0, nextdef=#defined-globals, nundef=#imports.  We tracked
    * those during build_symtab; recompute by inspecting strtab... easier
    * to recount: defined globals are total - imports. */
   u32 nlocal = 0;
   u32 nundef = x.nimports_real;
   u32 nextdef = (x.nsyms > nundef) ? x.nsyms - nundef - nlocal : 0;
   objbb_u32(&lc, LC_DYSYMTAB);
   objbb_u32(&lc, MACHO_DYSYMTAB_CMD_SIZE);
   objbb_u32(&lc, 0); /* ilocalsym */
   objbb_u32(&lc, nlocal);
   objbb_u32(&lc, nlocal);
   objbb_u32(&lc, nextdef);
   objbb_u32(&lc, nlocal + nextdef);
   objbb_u32(&lc, nundef);
   objbb_u32(&lc, 0);
   objbb_u32(&lc, 0); /* tocoff, ntoc */
   objbb_u32(&lc, 0);
   objbb_u32(&lc, 0); /* modtaboff, nmodtab */
   objbb_u32(&lc, 0);
   objbb_u32(&lc, 0); /* extrefsymoff, nextrefsyms */
   objbb_u32(&lc, x.indirect_off);
   objbb_u32(&lc, x.indirect.len / 4u);
   objbb_u32(&lc, 0);
   objbb_u32(&lc, 0); /* extreloff, nextrel */
   objbb_u32(&lc, 0);
   objbb_u32(&lc, 0); /* locreloff, nlocrel */
 
   /* LC_LOAD_DYLINKER */
   {
     const char* dyld = "/usr/lib/dyld";
     u32 dyld_len = (u32)slice_from_cstr(dyld).len;
     u32 cmd_size = (u32)ALIGN_UP((u64)(12u + dyld_len + 1u), 8u);
     objbb_u32(&lc, LC_LOAD_DYLINKER);
     objbb_u32(&lc, cmd_size);
     objbb_u32(&lc, 12u); /* name offset within cmd */
     u32 wrote = objbb_str(&lc, dyld, dyld_len);
     (void)wrote;
     /* Pad to cmd_size. */
     while (lc.len < (u32)((u64)objbb_align(&lc, 1) + 0)) {
       /* no-op */
       break;
     }
     /* Re-align to cmd_size. */
     u32 want = (u32)(lc.len);
     /* Walk back: lc grew by 12 + (strlen+1).  Pad to cmd_size. */
     u32 cmd_start_back = lc.len - (12u + dyld_len + 1u);
     u32 pad_needed = cmd_size - (lc.len - cmd_start_back);
     while (pad_needed-- > 0) objbb_u8(&lc, 0);
     (void)want;
   }
 
   /* LC_UUID */
   objbb_u32(&lc, LC_UUID);
   objbb_u32(&lc, 24);
   objbb_append(&lc, x.uuid, 16);
 
   /* LC_BUILD_VERSION */
   objbb_u32(&lc, LC_BUILD_VERSION);
   objbb_u32(&lc, 24);
   objbb_u32(&lc, macho_platform_for_target(img->c->target));
   objbb_u32(&lc, (12u << 16) | 0); /* minos 12.0.0 */
   objbb_u32(&lc, (12u << 16) | 0); /* sdk   12.0.0 */
   objbb_u32(&lc, 0);               /* ntools */
 
   /* LC_MAIN — entryoff is offset within __TEXT segment from its file
    * start (0). */
   objbb_u32(&lc, LC_MAIN);
   objbb_u32(&lc, 24);
   objbb_u64(&lc, (u64)x.entry_offset); /* entryoff = vaddr - __TEXT.vmaddr */
   objbb_u64(&lc, 0);                   /* stacksize */
 
   /* LC_LOAD_DYLIB per dylib. */
   for (u32 i = 0; i < x.ndylibs; ++i) {
     Slice nm_s = pool_slice(x.c->global, x.dylibs[i].install);
     const char* nm = nm_s.s;
     size_t nl = nm_s.len;
     u32 cmd_size = (u32)ALIGN_UP((u64)(24u + (u32)nl + 1u), 8u);
     u32 cmd_start = lc.len;
     objbb_u32(&lc, LC_LOAD_DYLIB);
     objbb_u32(&lc, cmd_size);
     objbb_u32(&lc, 24u);        /* name offset */
     objbb_u32(&lc, 0);          /* timestamp */
     objbb_u32(&lc, (1u << 16)); /* current_version 1.0 */
     objbb_u32(&lc, (1u << 16)); /* compat_version 1.0 */
     objbb_str(&lc, nm ? nm : "", (u32)nl);
     while (lc.len - cmd_start < cmd_size) objbb_u8(&lc, 0);
   }
 
   /* LC_FUNCTION_STARTS / LC_DATA_IN_CODE */
   objbb_u32(&lc, LC_FUNCTION_STARTS_C);
   objbb_u32(&lc, 16);
   objbb_u32(&lc, x.fn_starts_off);
   objbb_u32(&lc, x.fn_starts.len);
 
   objbb_u32(&lc, LC_DATA_IN_CODE_C);
   objbb_u32(&lc, 16);
   objbb_u32(&lc, x.data_in_code_off);
   objbb_u32(&lc, 0);
 
   /* LC_CODE_SIGNATURE */
   objbb_u32(&lc, LC_CODE_SIGNATURE_C);
   objbb_u32(&lc, 16);
   objbb_u32(&lc, x.codesig_off);
   objbb_u32(&lc, x.codesig_size);
 
   /* Sanity: lc.len + MACHO_HDR64_SIZE must equal headers_size we
    * predicted in plan_layout.  If not, we mis-sized — panic. */
   if ((u64)lc.len + MACHO_HDR64_SIZE != x.headers_size) {
     compiler_panic(x.c, SRCLOC_NONE,
                    "link_macho: load-cmd size mismatch: predicted %llu got %u",
                    (unsigned long long)(x.headers_size - MACHO_HDR64_SIZE),
                    lc.len);
   }
 
   /* ---- now stream the file ---- */
   /* The Writer in kit allows seek; we'll write a flat buffer first
    * (so we can hash it for codesig) and flush at the end. */
   ObjByteBuf file;
   objbb_init(&file, x.h);
 
   /* mach_header_64 */
   u32 ncmds = 0;
   /* Recount: PAGEZERO + TEXT + maybe DATA_CONST + maybe DATA + LINKEDIT
    * + chained + exports_trie + symtab + dysymtab + dyld + uuid +
    * build_version + main + nDylibs + fn_starts + data_in_code +
    * codesig. */
   ncmds += 2; /* PAGEZERO + TEXT */
   if (x.segs[2].nsects > 0) ncmds++;
   if (x.segs[3].nsects > 0) ncmds++;
   if (x.segs[MSEG_DWARF].nsects > 0) ncmds++; /* __DWARF (debug info) */
   ncmds++;                                    /* LINKEDIT */
   ncmds += 11 + x.ndylibs;
   /* (chained, exports_trie, symtab, dysymtab, dyld, uuid, build_version,
    *  main, fn_starts, data_in_code, codesig) = 11 */
 
   objbb_u32(&file, MH_MAGIC_64);
   objbb_u32(&file, x.macho->cputype);
   objbb_u32(&file, x.macho->cpusubtype);
   objbb_u32(&file, MH_EXECUTE);
   objbb_u32(&file, ncmds);
   objbb_u32(&file, lc.len);
   {
     u32 mh_flags = MH_DYLDLINK | MH_TWOLEVEL | MH_NOUNDEFS | MH_PIE;
     /* dyld scans __thread_vars and allocates a pthread_key for each
      * descriptor only when this flag is set; without it the descriptor's
      * thunk pointer is silently patched to _tlv_bootstrap_error.  Apple's
      * ld sets it whenever the image contains S_THREAD_LOCAL_* sections. */
     if (x.ntlv) mh_flags |= MH_HAS_TLV_DESCRIPTORS;
     objbb_u32(&file, mh_flags);
   }
   objbb_u32(&file, 0); /* reserved */
   objbb_append(&file, lc.data, lc.len);
 
   /* Pad to first section's file offset. */
   /* __TEXT first section begins at headers_size; we wrote header+lc =
    * headers_size, so no pad needed.  Then each MSec's file_offset
    * tells us where to write its bytes. */
 
   /* Now emit segment payload bytes per MSec. */
   for (u32 i = 0; i < x.nsecs; ++i) {
     MSec* m = &x.secs[i];
     if (m->is_zerofill || m->size == 0) continue;
     /* Pad up to m->file_offset. */
     while (file.len < m->file_offset) objbb_u8(&file, 0);
     if (m->synth_data) {
       objbb_append(&file, m->synth_data, m->synth_size);
     } else {
       LinkSection* ls = &img->sections[m->link_sec_id - 1u];
       u32 segid = ls->segment_id;
       u8* base =
           (segid != LINK_SEG_NONE) ? img->segment_bytes[segid - 1u] : NULL;
       if (base && ls->size) {
         objbb_append(&file, base + ls->input_offset, (u32)ls->size);
       } else if (ls->size) {
         for (u64 k = 0; k < ls->size; ++k) objbb_u8(&file, 0);
       }
     }
   }
 
   /* Pad to LINKEDIT start. */
   while (file.len < x.linkedit_fileoff) objbb_u8(&file, 0);
 
   /* LINKEDIT contents in declared order. */
   while (file.len < x.chained_fixups_off) objbb_u8(&file, 0);
   objbb_append(&file, x.chained_fixups.data, x.chained_fixups.len);
   while (file.len < x.exports_trie_off) objbb_u8(&file, 0);
   objbb_append(&file, x.exports_trie.data, x.exports_trie.len);
   while (file.len < x.fn_starts_off) objbb_u8(&file, 0);
   objbb_append(&file, x.fn_starts.data, x.fn_starts.len);
   while (file.len < x.data_in_code_off) objbb_u8(&file, 0);
   /* empty */
   while (file.len < x.symtab_off) objbb_u8(&file, 0);
   objbb_append(&file, x.symtab.data, x.symtab.len);
   while (file.len < x.indirect_off) objbb_u8(&file, 0);
   objbb_append(&file, x.indirect.data, x.indirect.len);
   while (file.len < x.strtab_off) objbb_u8(&file, 0);
   objbb_append(&file, x.strtab.data, x.strtab.len);
   while (file.len < x.codesig_off) objbb_u8(&file, 0);
 
   /* Compute codesig hashes over file bytes [0, codesig_off). */
   /* The codesig blob currently has zero hashes; hash now. */
   compute_codesig(&x, file.data, x.codesig_off, "a.out");
   /* Append codesig. */
   objbb_append(&file, x.codesig.data, x.codesig.len);
 
   /* Stream out. */
   kit_writer_seek(w, 0);
   kit_writer_write(w, file.data, file.len);
 
   /* Cleanup. */
   fix_fini(&fl);
   objbb_fini(&lc);
   objbb_fini(&file);
   objbb_fini(&x.chained_fixups);
   objbb_fini(&x.exports_trie);
   objbb_fini(&x.symtab);
   objbb_fini(&x.strtab);
   objbb_fini(&x.indirect);
   objbb_fini(&x.fn_starts);
   objbb_fini(&x.data_in_code);
   objbb_fini(&x.codesig);
   if (x.imports) x.h->free(x.h, x.imports, 0); /* VEC_GROW: cap unknown */
   if (x.dylibs) x.h->free(x.h, x.dylibs, 0);
   if (x.sym_to_imp)
     x.h->free(x.h, x.sym_to_imp, sizeof(u32) * x.sym_to_imp_size);
   if (x.secs) x.h->free(x.h, x.secs, 0);
   if (x.by_link_sec)
     x.h->free(x.h, x.by_link_sec, sizeof(MSec*) * x.by_link_sec_cap);
   if (x.stubs_bytes) x.h->free(x.h, x.stubs_bytes, x.stubs_size);
   if (x.got_bytes) x.h->free(x.h, x.got_bytes, x.got_size);
   if (x.tlv_ptrs_bytes) x.h->free(x.h, x.tlv_ptrs_bytes, x.tlv_ptrs_size);
   if (x.tlv_slots) x.h->free(x.h, x.tlv_slots, 0);
   if (x.sym_to_tlv)
     x.h->free(x.h, x.sym_to_tlv, sizeof(u32) * x.sym_to_tlv_size);
 }