ntdll: 64-bit images with a fixed base below 4 GB, TEB ceiling, one child boot at a time; pin wine and FEX

[spitefulowl]

Low priority. Depends on willfaust/wine#24 and willfaust/FEX#12 (see Merge order).

Updated onto main (3f87f36)

Rebased onto the merged batch. No commit was dropped. The only overlap is with #141 and 19cbce3:

• Give a pseudo-process child's emulator and pool copies its own ntdll #141 added the same ios_jit_alias_pushback_peb (the process whose FEX holds the alias-push callback), set in unixcall_ios_push_jit_aliases. That one declaration is kept. This PR no longer declares or sets its own copy and only reads upstream's.
• ios_push_subfloor_window loads the callback once with acquire, as 19cbce3 does. It then compares the window's owner with that process. The registration path stores the process before its release store of the callback.
• The catch-up loop of a registering emulator pushes the windows of the registering process and the shared ones.
• The new arity of ios_subfloor_enum / ios_push_subfloor_window also changes their stubs in tests/host/check-child-ntdll-alias.py (Give a pseudo-process child's emulator and pool copies its own ntdll #141).

Commits

1. Run 64-bit images with a fixed base below 4 GB

Background: a 64-bit PE whose fixed base is below 4 GB and whose relocations are stripped (the default output of Delphi Win64 and older MinGW toolchains, typically at 0x400000) cannot be mapped at its base on iOS. It is mapped high, and its low addresses are served by the sub-floor window.

Such a program failed at every step. Each fix below showed its own log line in a device run on 2026-10-01, and the failure it targeted did not recur:

• ml1195, load. The header now names the real base, so the loader no longer refuses the image with c0000018.
• ml1201, VirtualProtect/VirtualQuery. On the image's own low addresses these are translated to the real mapping.
• ml1202, FlushInstructionCache. On a low address it flushes the real mapping instead of SEGV-ing.
• ml1203, unwind data. The unix side answers NtQueryVirtualMemory class 1006 for ntdll ARM64EC: unwind data for x64 code running at a fixed base below 4 GB wine#24, so exceptions raised at low RIPs are handled.
• ml1204. A relocatable DLL with the same preferred base no longer re-points a running image's window.
• ml1205, windows per process. Windows carry the owner's PEB, so two processes with images at the same low base no longer run each other's code. A window goes only to the FEX of its own process: the callback's process is upstream's ios_jit_alias_pushback_peb. Windows are released at process exit, and the table grows from 8 to 32 slots.
• ml1206. A stripped fixed-base exe starts at the low address of its entry point.
• ml1208. The store emulator handles CASB/CASH in all forms. A misaligned halfword is emulated without atomicity.

Kill switches: MADEIRA_SUBFLOOR_VM, MADEIRA_SUBFLOOR_SEH and MADEIRA_SUBFLOOR_LOWENTRY (default on).

Fixes found in review, built only:

• The KUSER_SHARED_DATA window is no longer translated, so VirtualProtect(0x7ffe0000, PAGE_READWRITE) fails as on Windows.
• ios_subfloor_window_held reads the holder's headers fault-safe.

2. Reserve 64-bit TEB blocks without the WoW64 address ceiling (ml1210)

user_space_wow_limit is session-wide here. After any 32-bit process, a 64-bit thread's next TEB block was requested below 4 GB, where iOS maps nothing, so a 64-bit program could not create its 33rd thread. The ceiling now applies to WoW TEB blocks only.

Verified on the device: new 64-bit TEBs come from a high block, and no more threads are killed.

3. Child processes boot one at a time (ml1213)

A child process is a thread of the app that works through session-wide state during start-up. Two children created a few ms apart corrupted each other's start-up ([init-peb] ... MISMATCH), and both died. A mutex now covers a child's unix boot.

• Verified on the device: the waits are logged, children boot in turn, and the mismatch is gone.
• Built only: a child that dies through pthread_exit during init releases the lock through a pthread key destructor. A TSan harness on macOS confirms it.
• Not covered: a child whose boot hangs without exiting still holds the lock. The cost of serialising boots was not measured on Steam or CEF helper bursts.

4. Pin wine and FEX

The pins move to the heads of:

• ntdll ARM64EC: unwind data for x64 code running at a fixed base below 4 GB wine#24: unwind data for low pcs;
• WOW64/ARM64EC iOS: keep a terminated thread's JIT state; invalidate sub-floor code under both names FEX#12: TerminateThread keeps the target's JIT state, and sub-floor code is invalidated under both of its names.

Pins: wine f4bbccf9499, FEX c9fe957cf0d (rebased onto the FEX commit main pins now).

Known gaps (from review)

• One global FEX callback: a window registered after another process replaced it is not pushed to its owner's FEX. Since Give a pseudo-process child's emulator and pool copies its own ntdll #141 the callback is dropped when its process exits, so nothing is pushed into a dead emulator, but this gap remains.
• Lock-free window readers are not re-validated.

Merge order

The pins point at the head commits of willfaust/wine#24 and willfaust/FEX#12, which so far exist only in the spitefulowl forks. Merge those two first.

• If they are merged with merge commits, the pinned commits are then in willfaust/wine and willfaust/FEX unchanged, and this PR can follow as is.
• If they are squashed or rebased, I will move the pins to the resulting commits before this one is merged.

Rebuild (no binaries in this PR)

• libntdll_unix.a (build/ntdll-unix/build.sh)
• arm64ec-windows/ntdll.dll (build/wine-pe/build-ntdll.sh)
• arm64ec-windows/xtajit64.dll (build/fex-arm64ec/build.sh)
• aarch64-windows/xtajit.dll (build/fex-wow64/build.sh)

Checks

• clang -fsyntax-only with build.sh's flags passes for the changed files of every commit (Xcode 27 / iOS SDK 27.0). At the head, they give the same warnings as on main.
• tests/host gives the same results as on main. check-child-ntdll-alias, check-image-reload and check-iat-sync-owner pass. The tests that fail here also fail on main on this host (Linux headers, or submodules not checked out).
• ConfigCatalog is regenerated and current.

🤖 Generated with Claude Code