QEMU does for its user-mode-only code, but not in JITted code. We have a little shim that directly executes a syscall instruction because we want to be able to

QEMU does for its user-mode-only code, but not in JITted code. We have a little shim that directly executes a syscall instruction because we want to be able to wind the PC forward/backward across it to avoid a race condition with a signal arriving after the guest thinks it's made the syscall but before we've made the syscall in the host. But that's currently only done by linux-user; bsd-user should ideally have a similar mechanism but is basically dead/dying for lack of maintainers who care about the BSDs. In any case, that falls under "in the binary's text segment" rather than JIT output. (code at https://git.qemu.org/?p=qemu.git;a=blob;f=linux-user/host/x86_64/safe-syscall.inc.S;h=f36992daa34e0f59c621d506bdda00e281e437be;hb=HEAD https://git.qemu.org/?p=qemu.git;a=blob;f=linux-user/host/x8... )