--- libmalloc/libmalloc-140.40.1/man/malloc.3
+++ libmalloc/libmalloc-792.41.1/man/malloc.3
@@ -27,7 +27,8 @@
 .Nm malloc ,
 .Nm realloc ,
 .Nm reallocf ,
-.Nm valloc
+.Nm valloc ,
+.Nm aligned_alloc
 .Nd memory allocation
 .Sh SYNOPSIS
 .In stdlib.h
@@ -56,6 +57,11 @@
 .Fc
 .Ft void *
 .Fo valloc
+.Fa "size_t size"
+.Fc
+.Ft void *
+.Fo aligned_alloc
+.Fa "size_t alignment"
 .Fa "size_t size"
 .Fc
 .Sh DESCRIPTION
@@ -70,6 +76,9 @@
 The allocated memory is aligned such that it can be used for any data type,
 including AltiVec- and SSE-related types.
 The
+.Fn aligned_alloc
+function allocates memory with the requested alignment.
+The
 .Fn free
 function frees allocations that were created via the preceding allocation
 functions.
@@ -95,6 +104,14 @@
 .Fa size
 bytes of memory and returns a pointer to the allocated memory.
 The allocated memory is aligned on a page boundary.
+.Pp
+The
+.Fn aligned_alloc
+function allocates
+.Fa size
+bytes of memory with an alignment specified by
+.Fa alignment
+and returns a pointer to the allocated memory.
 .Pp
 The
 .Fn realloc
@@ -154,8 +171,9 @@
 .Fn malloc ,
 .Fn realloc ,
 .Fn reallocf ,
+.Fn valloc ,
 and
-.Fn valloc
+.Fn aligned_alloc
 functions return a pointer to allocated memory.
 If there is an error, they return a
 .Dv NULL
@@ -163,6 +181,23 @@
 .Va errno
 to
 .Er ENOMEM .
+.Pp
+In addition,
+.Fn aligned_alloc
+returns a
+.Dv NULL
+pointer and sets
+.Va errno
+to
+.Er EINVAL
+if
+.Fa size
+is not an integral multiple of
+.Fa alignment ,
+or if
+.Fa alignment
+is not a power of 2 at least as large as
+.Fn sizeof "void *" .
 .Pp
 For
 .Fn realloc ,
@@ -183,10 +218,13 @@
 The following environment variables change the behavior of the
 allocation-related functions.
 .Bl -tag -width ".Ev MallocStackLoggingNoCompact"
-.It Ev MallocLogFile <f>
-Create/append messages to the given file path
-.Fa <f>
-instead of writing to the standard error.
+.It Ev MallocDebugReport
+If set, specifies where messages are written. Set to "stderr" to write messages
+to the standard error stream, "none" to discard all messages and "crash" to
+write messages to standard error only for a condition that is about to cause a
+crash. When not set, message are written to the standard error stream if it
+appears to be a terminal (that is, if isatty(STDERR_FILENO) returns a non-zero
+value) and are otherwise discarded.
 .It Ev MallocGuardEdges
 If set, add a guard page before and after each large block.
 .It Ev MallocDoNotProtectPrelude
@@ -200,11 +238,15 @@
 .Ev MallocGuardEdges
 environment variable is set.
 .It Ev MallocStackLogging
-The default behavior if this is set is to record all allocation and deallocation events to an on-disk log, along with stacks, so that tools like
+The default behavior when set to 1 is "lite" mode as described below.
+.Pp
+Set to "lite" to record stack traces for current allocations only, without history, so that tools like
 .Xr leaks 1
 and
 .Xr malloc_history 1
-can be used.
+can later use them. These are recorded to in-memory data structures and do not write to the filesystem.
+.Pp
+Set to "full" to record allocation and deallocation events to an on-disk log, along with stacks, for later use by analysis tools. The process must have write access to the pre-existing output directory, which can be specified with MallocStackLoggingDirectory.
 .Pp
 Set to "vm" to record only allocation of virtual memory regions allocated by system calls and mach traps, such as by
 .Xr mmap 1
@@ -214,11 +256,8 @@
 .Xr malloc 3
 and related interfaces, not virtual memory regions.
 .Pp
-Set to "lite" to record current allocations only, not history.   These are recorded by in-memory data structures, instead of an on-disk log.
 .It Ev MallocStackLoggingNoCompact
-If set, record all stacks in a manner that is compatible with the
-.Nm malloc_history
-program.
+If set, implies MallocStackLogging in "full" mode and disables eliding of adjacent malloc/free events operating on the same address.
 .It Ev MallocStackLoggingDirectory
 If set, records stack logs to the directory specified instead of saving them to the default location (/tmp).
 .It Ev MallocScribble
@@ -227,7 +266,9 @@
 freshly allocated memory will fail.
 Also if set, fill memory that has been deallocated with 0x55 bytes.
 This increases the likelihood that a program will fail due to accessing memory
-that is no longer allocated.
+that is no longer allocated. Note that due to the way in which freed memory is
+managed internally, the 0x55 pattern may not appear in some parts of a
+deallocated memory block.
 .It Ev MallocCheckHeapStart <s>
 If set, specifies the number of allocations
 .Fa <s>
@@ -278,6 +319,26 @@
 but will not abort in out of memory conditions, making it more useful to catch
 only those errors which will cause memory corruption.
 MallocCorruptionAbort is always set on 64-bit processes.
+.It Ev MallocZeroOnFree
+Starting in macOS 13, iOS 16.1 and aligned releases,
+.Xr free 3
+fully zeroes many blocks immediately.
+This may expose some previously-silent bugs in existing applications.
+In particular, read-after-free bugs may now observe zeroes instead of the
+previous content of an allocation, and write-after-free bugs may cause
+.Xr calloc 3
+to return non-zero memory.
+.Ev MallocZeroOnFree
+can be set to 0 or 1 to explicitly disable or enable this zeroing behavior to
+aid in diagnosing such bugs.
+Support for this environment variable will eventually be removed, and it should
+not be used by shipping software.
+.It Ev MallocCheckZeroOnFreeCorruption
+When zero-on-free behavior is active, this environment variable can be set to 1
+to cause the allocator to check that the free block chosen for a given
+allocation remained fully zeroed and was not corrupted by any invalid
+use-after-free writes.
+If corruption is detected, the allocator will abort.
 .It Ev MallocHelp
 If set, print a list of environment variables that are paid heed to by the
 allocation-related functions, along with short descriptions.