From db6901988d282ba3e309e8bb9260ed90f0261185 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Tue, 14 Jul 2026 09:24:58 -0400
Subject: [PATCH 1/2] darwin.libffi: check that the trampoline dylib is built
 correctly

---
 .../darwin/by-name/li/libffi/package.nix      | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/pkgs/os-specific/darwin/by-name/li/libffi/package.nix b/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
index 0411e61a1f9e..6a46e4cc0a5c 100644
--- a/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
+++ b/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
@@ -3,6 +3,9 @@
   autoreconfHook,
   dejagnu,
   mkAppleDerivation,
+  runCommand,
+  dyld,
+  python3,
   stdenv,
   testers,
   texinfo,
@@ -12,6 +15,10 @@
   doCheck ? !(stdenv.hostPlatform.isStatic),
 }:
 
+let
+  python3-with-macholib = python3.withPackages (pkgs: [ pkgs.macholib ]);
+in
+
 mkAppleDerivation (finalAttrs: {
   releaseName = "libffi";
 
@@ -94,6 +101,32 @@ mkAppleDerivation (finalAttrs: {
       pkg-config = testers.hasPkgConfigModules {
         package = finalAttrs.finalPackage;
       };
+      # Done as a passthru test to avoid pulling dyld into the Darwin bootstrap just for `dyld_info`.
+      # `dyld_info` is needed because `check-trampolines-dylib.py` does not check chained fixups.
+      check-trampolines-dylib =
+        runCommand "check-trampolines-dylib"
+          {
+            inherit (finalAttrs) src version;
+
+            nativeBuildInputs = [
+              dyld
+              python3-with-macholib
+            ];
+            buildInputs = [ finalAttrs.finalPackage ];
+
+            meta = {
+              description = "Test whether the libffi trampoline was built correctly and works on Darwin.";
+              inherit (finalAttrs.meta) license platforms;
+            };
+          }
+          ''
+            runPhase unpackPhase
+            trampolineDylib=${lib.escapeShellArg (lib.getLib finalAttrs.finalPackage)}/lib/libffi-trampolines.dylib
+            patchShebangs check-trampolines-dylib.py
+            ./check-trampolines-dylib.py "$trampolineDylib"
+            dyld_info -fixups "$trampolineDylib" | grep -v "chained fixups, seg_count exceeds number of segments"
+            touch "$out"
+          '';
     };
   };
 

From 31ac410db37503704af446f2cad40811fabe0b04 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Tue, 14 Jul 2026 09:24:58 -0400
Subject: [PATCH 2/2] darwin.libffi: disable linking with chained fixups
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The dylib was apparently built with invalid chained fixups. This hasn’t
been a problem in the past, but dyld under macOS 27 is apparently
stricter now about which binaries it will load. Binaries using the
trampolines crash under macOS 27. Disabling them fixes those crashes.
---
 pkgs/os-specific/darwin/by-name/li/libffi/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/darwin/by-name/li/libffi/package.nix b/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
index 6a46e4cc0a5c..1cfe8955c660 100644
--- a/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
+++ b/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
@@ -68,7 +68,7 @@ mkAppleDerivation (finalAttrs: {
   '';
 
   postBuild = ''
-    $CC -Os -Wl,-allowable_client,! -Wl,-not_for_dyld_shared_cache -Wl,-no_compact_unwind \
+    $CC -Os -Wl,-allowable_client,! -Wl,-not_for_dyld_shared_cache -Wl,-no_compact_unwind  -Wl,-no_fixup_chains \
       src/aarch64/trampoline.S -dynamiclib -o libffi-trampolines.dylib \
       -Iinclude -Ibuild -Ibuild/include \
       -install_name "$out/lib/libffi-trampoline.dylib" -Wl,-compatibility_version,1 -Wl,-current_version,1