When in doubt, consult the source: https://github.com/opensource-apple/xnu/blob/53c5e2e62fc4182595609153d4b99648da577c39/bsd/kern/kern_exec.c#L4131 https://gith

When in doubt, consult the source: https://github.com/opensource-apple/xnu/blob/53c5e2e62fc4182595609153d4b99648da577c39/bsd/kern/kern_exec.c#L4131 https://github.com/opensource-apple/xnu/blob/53c5e2e62fc4182... The upshot is that it looks like it constructs some non-env variable environment data on the program's stack after the posix environment. The absolute path of the executable, followed by preemption free zone addresses, entropy, a configuration setting for malloc allocation strategy, and the address of the main thread's stack afaict.