It's because this environment manipulation occurs after ld.so sanitized the environment, and there are opportunities to then trigger behavior based on the envir

It's because this environment manipulation occurs after ld.so sanitized the environment, and there are opportunities to then trigger behavior based on the environment before pkexec re-sanitizes it. The GCONV_PATH variable in particular makes it load shared code when attempting to log an error.