Give a pseudo-process child's emulator and pool copies its own ntdll

[bahacan16]

Problem

An x64 pseudo-process child dies at its first x64 syscall. GTA V Enhanced (PlayGTAV.exe and GTA5_Enhanced.exe start each other as children) died this way in both start orders, and so did Ghost of Tsushima's crs-handler.exe. The child's thread hits NoExec instruction in entry block and ends in an access violation ([iOS-xquery] MISS ... addr=<child ntdll copy>+0x87050).

Once that was fixed, the same child died again later in two related ways: a [stale-heal] rewrote a slot in the child's emulator copy to the parent's ntdll, and the NtProtectVirtualMemory IAT sync wrote the child's ntdll change into the parent's ntdll copy.

Cause

A child runs a private ntdll copy (ios_jit_copy_module_for_child, owner_peb = the child), but three places still used the parent's copy:

1. Alias drain. Every x64 pseudo-process loads its own emulator with its own alias table. unixcall_ios_push_jit_aliases skipped every owner-tagged mapping, so the child's emulator mapped ntdll to the PARENT's copy. ntdll's dispatch_syscall (EC code running from the child's copy) sets the x64 Pc to invoke_arm64ec_syscall in the child's pool copy; FEX can map a pool RIP back to its PE VA only through this table ([pool-rip-fix]), missed, and refused the block.
2. Stale-pointer heal. ios_jit_patch_stale_pointer translated each copy by its owner_peb, which is set only for the per-process ntdll copies. Everything else a child maps (its emulator, exe, DLLs) has owner NULL, so a stale ntdll PE VA in it was healed to the session's ntdll copy. GTA's child then ran the parent's KiUserExceptionDispatcher on its next syscall (NoExec at the parent's invoke_arm64ec_syscall).
3. IAT sync. The NtProtectVirtualMemory sync copied the region into the FIRST mapping whose PE range holds it. ntdll has the session copy plus one per child, so a child's change to ntdll went to the parent's copy.

Change

build/ntdll-unix/virtual_ios.c only:

• struct ios_jit_mapping gets map_peb, the process whose thread registered the copy (ios_jit_add_mapping: ios_jit_current_peb(); child ntdll copy: the child).
• The alias drain pushes the registering process's own copy of an image instead of the NULL-owner entry when it has one (FEX keeps one entry per PE range, so exactly one of the two is pushed). Other processes' copies are never pushed. A main process owns no copies, so its drain is unchanged.
• ios_jit_reclaim_process drops the alias-push callback when the dying process is the one whose emulator holds it; otherwise the next image map would call into its reclaimed pool copy. The next emulator to register gets the whole table from its drain.
• The stale heal translates each copy for owner_peb, else map_peb. A copy of an unknown process is left alone when the target image has per-process copies (the owner-aware exec-fault redirect keeps serving it). Tombstoned entries are skipped.
• ios_iat_sync_pick_mapping: the copy owned by the writing process, else the first NULL-owner copy, else the first match (the rule of ios_jit_translate_addr_for_owner). The sync loop only syncs that copy.

New log lines: [alias-push] once per child emulator registration (only when it gets its own copy) and once when a callback is dropped; [stale-heal] ... left to the owner-aware fault redirect when a copy is skipped.

Host tests (ported from the fork, compile the production functions): tests/host/check-child-ntdll-alias.py (models one FEX alias table per emulator and replays the GTA child layout), check-stale-heal-owner.py, check-iat-sync-owner.py. All pass with ASan/UBSan, as do the existing check-image-retire, check-lazy-windows, check-small-va-band, check-unixlib-binder.

Evidence

iPhone 17 Pro Max, iOS 27, GTA V Enhanced:

• Before: the child died at its first x64 syscall in both start orders.
• With the drain fix: the child's emulator maps ntdll to its own copy ([alias-push] ... own copy), [pool-rip-fix] fires in the child, no NoExec; both start paths run the game child (also GTA5 -> PlayGTAV -> GTA5 grandchild).
• With the heal fix: no crash any more; the game reaches its own in-game screen; the heal reports each copy translated for its process, no NoExec.
• With the IAT-sync fix: the child's ntdll changes go to its own copy.
• God of War and Ghost of Tsushima (main process only) unchanged.

Notes / risks

• Main processes own no copies, so the drain, the heal and the sync behave exactly as before for them; only pseudo-process children change.
• The fork had env switches for each of the three rules (MADEIRA_CHILD_OWN_NTDLL, MADEIRA_HEAL_OWNER, MADEIRA_IAT_SYNC_OWNER, =0 = old rule); they are dropped here since the change is device-proven and limited to children.
• Not ported: in the fork a child's ntdll copy also gets the RtlPcToFileHeader pool-alias patch (ios_patch_rtl_pc_to_file_header_current); that patch is part of the separate C++ exception PR (pr/cxx-exceptions-pool-aliases), which already includes the child variant. Diagnostic-only lines (cross- process push census) were left out.
• Known, not changed: the alias-push callback is global, so images mapped after a child registered its emulator go to that child's emulator, also when the main process maps them (they then take the exec-fault redirect in the main process).
• Not compiled for iOS here; a differential clang -fsyntax-only of virtual_ios.c against upstream shows no new diagnostics.

---

🤖 Generated with Claude Code

Claude-Session: https://claude.ai/code/session_0189oLHghpaYKLk4f786a6bc