[mugurc]

What

sceSystemServiceLoadExec on macOS hosts. It found the running executable through /proc/self/exe and replaced the process with fexecve after close_range, none of which macOS has, so on macOS every call other than "exit" threw. Part of the macOS series announced on #1 (#1 (comment)).

• The running executable's path comes from _NSGetExecutablePath, resolved with std::filesystem::canonical, as libSceNpEntitlementAccess and libSceFont already do on macOS. The rest of PrepareLaunch is the Linux code.
• The target must be an x86-64 Mach-O executable (MH_MAGIC_64, CPU_TYPE_X86_64, MH_EXECUTE) that the user may run, as Linux requires an x86-64 ELF.
• macOS has no fexecve, so the process is replaced by path with posix_spawn and POSIX_SPAWN_SETEXEC. POSIX_SPAWN_CLOEXEC_DEFAULT closes every descriptor except the standard streams, which is what close_range does on Linux. The PID stays and the working directory becomes the executable's, as on Linux.
• Before the replacement it starts the exit and runs the shutdown callbacks (LibcStartExit_nid_postfix, then LibcRunShutdown_nid_postfix), as the Linux and Windows Replace do since fix(libSceSystemService): park guest threads during LoadExec's shutdown as exit does #6237.
• Descriptor 2 gets the host standard error back before the replacement, as fix(libSceSystemService): give LoadExec's next executable the host standard error #5699 does on Linux, so the next executable writes to the host's standard error and not to where the title redirected descriptor 2. A launch with no argument list keeps the Linux execv path, which macOS has and which already does this.
• guest_system_exit finds its own executable the same way on macOS, and guest_system_load_exec_standard_error from fix(libSceSystemService): give LoadExec's next executable the host standard error #5699 now runs on macOS too. In docs/dev/debt/libSceSystemService.md the sceSystemServiceLoadExec entry describes macOS instead of listing it as a host that throws, and the LoadExec descriptors entry says how macOS closes the descriptors.

Tested

• macOS 26.5.1, Apple M5 Max, Apple clang 21, x86-64 build under Rosetta 2, main 385ed71 with the other macOS branches of the series and the open macOS fixes fix(libkernel): create the JIT shared memory backing on macOS hosts #6928, fix(libkernel_sys): build and check fchdir search permission on macOS #6667, fix(libSceLibcInternal): read statvfs by path on macOS #6668, fix(tests): keep generic category vtable entries castable to functions #6969, fix(libc): keep errno when strtol converts nothing on macOS #6853, fix(libkernel): set the open file limit at load on macOS #6836, perf(libc): add steady_clock fast path in PreciseSleepUntil #6620 and fix(tests): compare the Bessel exports with fixed reference values #7524 (the libraries do not link on macOS without the series): guest_system_exit_parameters, guest_system_relaunch and guest_nested_exit, which failed before, pass, and so does guest_system_load_exec_standard_error; the four passed 10 runs in a row; guest_system_exit, guest_requested_exit, guest_quick_exit, guest_immediate_exit, guest_return_from_main, guest_exit_finalizers_before_shutdown, guest_system_service and guest_system_service_language pass. guest_system_relaunch replaces the process twice, into a copy named picker.picker.bin and back to the main executable through APS5_EBOOT, and checks the arguments and shutdown handlers of each step.
• Linux and Windows: not run. Every change to the library is under __APPLE__ except OwnExecutable, which moves the Linux /proc/self/exe lookup into a function without changing it.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source (none added)
• Generic behaviour, not specific to one title
• Depends on: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

[github-actions]

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 6044	core/libs/prx/libSceSystemService/CMakeLists.txt core/libs/tests/GuestSystemExit.cpp
PR 6447	core/libs/prx/libSceSystemService/Export.cpp
PR 7201	core/libs/prx/libSceSystemService/Export.cpp core/libs/prx/libSceSystemService/LoadExec.cpp core/libs/tests/GuestSystemExit.cpp

[milescoviello]

A heads-up on ordering with #6237. It changes LoadExec's shutdown on Linux and Windows from LibcRunShutdown_nid_postfix() to a new LibcStartExit_nid_postfix() (what exit does), so a guest thread that calls into a stopped library during it waits for the process to be replaced instead of getting ProcessShutdown back in title code. On Linux, MGS4's launcher and VLC's self-restart abort on main from that.

The macOS Replace here also calls LibcRunShutdown_nid_postfix() just before the spawn. If #6237 lands first, that call would want to become LibcStartExit_nid_postfix() too. If this lands first, I'll change it when I rebase #6237. The two PRs also both edit the sceSystemServiceLoadExec line in docs/dev/debt/libSceSystemService.md.

AI-assisted: yes

[mugurc]

Agreed. If #6237 lands first, I will rebase this and the macOS Replace will call LibcStartExit_nid_postfix(). If this lands first, the change is yours in the rebase of #6237. The two edits of the debt line are in different sentences, so either order resolves it by keeping both.