--- /dev/null
+++ libmalloc/libmalloc-521.120.7/src/sanitizer_malloc.c
@@ -0,0 +1,1274 @@
+/*
+ * Copyright (c) 2021 Apple Inc. All rights reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+#include <malloc/_platform.h>
+#include <stddef.h>
+
+#include "internal.h"
+
+#if CONFIG_SANITIZER
+
+#pragma mark -
+#pragma mark Types and Structures
+
+typedef struct {
+	// Malloc zone
+	malloc_zone_t malloc_zone;
+	malloc_zone_t *wrapped_zone;
+
+	// Configuration
+	bool debug;
+	bool do_poisoning;
+	size_t redzone_size; // minimum amount of right padding
+	size_t max_items_in_quarantine; // 0 means unlimited
+	size_t max_bytes_in_quarantine; // 0 means unlimited
+
+#if !MALLOC_TARGET_EXCLAVES
+	// Stacktrace tracking data structures
+	struct stacktrace_depo_t *depo;
+	struct pointer_map_t *map;
+
+	uint8_t padding[PAGE_MAX_SIZE];
+#endif /* !MALLOC_TARGET_EXCLAVES */
+
+	// Mutable state
+	_malloc_lock_s lock;
+	struct quarantined_chunk *quarantine_head;
+	struct quarantined_chunk *quarantine_tail;
+	size_t items_in_quarantine;
+	size_t bytes_in_quarantine;
+} sanitizer_zone_t;
+
+ASSERT_WRAPPER_ZONE(sanitizer_zone_t);
+
+#if !MALLOC_TARGET_EXCLAVES
+MALLOC_STATIC_ASSERT(offsetof(sanitizer_zone_t, padding) < PAGE_MAX_SIZE,
+		"First page is mapped read-only");
+MALLOC_STATIC_ASSERT(offsetof(sanitizer_zone_t, lock) >= PAGE_MAX_SIZE,
+		"Mutable state is on separate page");
+MALLOC_STATIC_ASSERT(sizeof(sanitizer_zone_t) < (2 * PAGE_MAX_SIZE),
+		"Zone fits on 2 pages");
+#endif /* !MALLOC_TARGET_EXCLAVES */
+
+#ifndef ASAN_SHADOW_ALIGNMENT
+#define ASAN_SHADOW_ALIGNMENT 8
+#endif /* ASAN_SHADOW_ALIGNMENT */
+
+#define DELEGATE(function, args...) \
+	zone->wrapped_zone->function(zone->wrapped_zone, args)
+
+#if MALLOC_TARGET_EXCLAVES
+static sanitizer_zone_t sanitizer_zone;
+#endif /* MALLOC_TARGET_EXCLAVES */
+
+// Lock helpers
+static void
+init_lock(sanitizer_zone_t *zone)
+{
+	_malloc_lock_init(&zone->lock);
+}
+
+static void
+lock(sanitizer_zone_t *zone)
+{
+	_malloc_lock_lock(&zone->lock);
+}
+
+static void
+unlock(sanitizer_zone_t *zone)
+{
+	_malloc_lock_unlock(&zone->lock);
+}
+
+static bool
+trylock(sanitizer_zone_t *zone)
+{
+	return _malloc_lock_trylock(&zone->lock);
+}
+
+// VM allocation/deallocate helpers
+#if !MALLOC_TARGET_EXCLAVES
+static vm_address_t
+sanitizer_vm_map(size_t size, vm_prot_t protection, int tag)
+{
+	vm_map_t target = mach_task_self();
+	mach_vm_address_t address = 0;
+	mach_vm_size_t size_rounded = round_page(size);
+	mach_vm_offset_t mask = 0x0;
+	int flags = VM_FLAGS_ANYWHERE | VM_MAKE_TAG(tag);
+	mem_entry_name_port_t object = MEMORY_OBJECT_NULL;
+	memory_object_offset_t offset = 0;
+	bool copy = false;
+	vm_prot_t cur_protection = protection;
+	vm_prot_t max_protection = VM_PROT_READ | VM_PROT_WRITE;
+	vm_inherit_t inheritance = VM_INHERIT_DEFAULT;
+
+	kern_return_t kr = mach_vm_map(target, &address, size_rounded, mask, flags,
+		object, offset, copy, cur_protection, max_protection, inheritance);
+	MALLOC_ASSERT(kr == KERN_SUCCESS);
+	return address;
+}
+
+static void
+sanitizer_vm_deallocate(vm_address_t addr, size_t size)
+{
+	vm_map_t target = mach_task_self();
+	mach_vm_address_t address = (mach_vm_address_t)addr;
+	mach_vm_size_t size_rounded = round_page(size);
+	kern_return_t kr = mach_vm_deallocate(target, address, size_rounded);
+	MALLOC_ASSERT(kr == KERN_SUCCESS);
+}
+
+static void
+sanitizer_vm_protect(vm_address_t addr, size_t size, vm_prot_t protection)
+{
+	vm_map_t target = mach_task_self();
+	mach_vm_address_t address = (mach_vm_address_t)addr;
+	mach_vm_size_t size_rounded = round_page(size);
+	bool set_maximum = false;
+	kern_return_t kr = mach_vm_protect(target, address, size_rounded, set_maximum, protection);
+	MALLOC_ASSERT(kr == KERN_SUCCESS);
+}
+
+// Env helpers
+static const char *
+env_var(const char *name)
+{
+	const char **env = (const char **)*_NSGetEnviron();
+	return _simple_getenv(env, name);
+}
+
+static bool
+env_bool(const char *name)
+{
+	const char *value = env_var(name);
+	if (!value) return false;
+	return value[0] == '1';
+}
+
+static uint32_t
+env_uint(const char *name, uint32_t default_value)
+{
+	const char *value = env_var(name);
+	if (!value) return default_value;
+	return (uint32_t)strtoul(value, NULL, 0);
+}
+
+static uint32_t
+stacktrace_depo_insert(struct stacktrace_depo_t *depo, uintptr_t * __counted_by(count) pcs, size_t count);
+
+static bool
+pointer_map_find(struct pointer_map_t *map, uintptr_t ptr, uint64_t *word_out);
+
+static void
+pointer_map_insert(struct pointer_map_t *map, uintptr_t ptr, uint64_t word);
+
+#define wrap(index, container) ((index) & (countof(container) - 1))
+
+static uint32_t OS_ALWAYS_INLINE
+insert_current_stacktrace_into_depo(struct stacktrace_depo_t *depo, uint32_t top_frames_to_ignore)
+{
+	void * __unsafe_indexable pcs[16 + top_frames_to_ignore];
+#if MALLOC_TARGET_EXCLAVES
+	ssize_t num_pcs = backtrace(pcs, countof(pcs));
+#else
+	uint32_t num_pcs;
+	thread_stack_pcs((uintptr_t *)pcs, (unsigned)countof(pcs), &num_pcs);
+#endif // MALLOC_TARGET_EXCLAVES
+	if (num_pcs <= top_frames_to_ignore) {
+		return 0;
+	}
+	const size_t num_frames = (size_t)num_pcs - top_frames_to_ignore;
+	return stacktrace_depo_insert(depo, (uintptr_t * __counted_by(num_frames))&pcs[top_frames_to_ignore], num_frames);
+}
+
+static void OS_ALWAYS_INLINE
+record_alloc_stacktrace(struct stacktrace_depo_t *depo, struct pointer_map_t *map, void *ptr, size_t size)
+{
+	if (ptr == NULL || size >= PAGE_SIZE) {
+		return;
+	}
+	uint32_t alloc_hash = insert_current_stacktrace_into_depo(depo, 1);
+	pointer_map_insert(map, (uintptr_t)ptr, alloc_hash);
+}
+#endif /* !MALLOC_TARGET_EXCLAVES */
+
+static void
+unpoison(sanitizer_zone_t *zone, void * __sized_by(size) ptr, size_t size);
+
+#pragma mark -
+#pragma mark Quarantine Logic
+
+typedef struct quarantined_chunk {
+	uint64_t next_and_size;
+#if !MALLOC_TARGET_EXCLAVES
+	uint64_t stacktrace_hashes;
+#endif /* !MALLOC_TARGET_EXCLAVES */
+} quarantined_chunk_t;
+
+MALLOC_STATIC_ASSERT(sizeof(quarantined_chunk_t) <= 16,
+		"quarantined_chunk_t must be 16 bytes to fit in all allocations");
+
+typedef union {
+	uint64_t i;
+	struct {
+		uint64_t next_ptr : 48;
+		uint64_t size : 16;
+	} parts;
+} next_and_size;
+
+MALLOC_STATIC_ASSERT(sizeof(next_and_size) == 8,
+		"next_and_size must be 8 bytes");
+
+static void OS_NOINLINE
+place_into_quarantine(sanitizer_zone_t *zone, void * __unsafe_indexable _ptr, size_t size)
+{
+	if (_ptr == NULL) {
+		return;
+	}
+
+	// We need to know the size of the chunk, for quarantine bookkeeping
+	if (size == 0) {
+		size = DELEGATE(size, _ptr);
+	}
+
+	void *ptr = __unsafe_forge_bidi_indexable(void *, _ptr, size);
+	// Don't quarantine large allocations to avoid one single huge allocation
+	// evicting the whole quarantine.
+	if (size > PAGE_SIZE) {
+		// Actually unpoison before handing back to the allocator. This is not
+		// always strictly necessary, but only when executing under memory
+		// instrumentation that may check the shadow map for us
+		if (zone->do_poisoning) {
+			unpoison(zone, ptr, size);
+		}
+
+		return DELEGATE(free, ptr);
+	}
+
+#if !MALLOC_TARGET_EXCLAVES
+	uint32_t dealloc_stack_hash = insert_current_stacktrace_into_depo(zone->depo, 2);
+	uint64_t stored_word = 0;
+	pointer_map_find(zone->map, (uintptr_t)ptr, &stored_word);
+	uint32_t alloc_stack_hash = (uint32_t)stored_word;
+	uint64_t hashes = alloc_stack_hash | (((uint64_t)dealloc_stack_hash) << 32);
+#endif
+
+	lock(zone);
+
+	// Append ptr to the tail of the quarantine list
+	if (zone->items_in_quarantine == 0) {
+		zone->quarantine_tail = zone->quarantine_head = ptr;
+	} else {
+		next_and_size n;
+		n.i = _malloc_read_uint64_via_rsp(&zone->quarantine_tail->next_and_size);
+		n.parts.next_ptr = (uintptr_t)ptr;
+		_malloc_write_uint64_via_rsp(&zone->quarantine_tail->next_and_size, n.i);
+		zone->quarantine_tail = ptr;
+	}
+	next_and_size n = { .parts = { .next_ptr = 0, .size = size } };
+	_malloc_write_uint64_via_rsp(&zone->quarantine_tail->next_and_size, n.i);
+#if !MALLOC_TARGET_EXCLAVES
+	_malloc_write_uint64_via_rsp(&zone->quarantine_tail->stacktrace_hashes, hashes);
+#endif
+
+	zone->items_in_quarantine += 1;
+	zone->bytes_in_quarantine += size;
+
+	// Now let's remove and free chunks from the quarantine list that are over
+	// limits. To minimize the work that we do under the zone lock, we only
+	// remove chunks from the quarantine list (i.e. we adjust quarantine_head
+	// and statistics), and then only actually free the chunks outside of the
+	// lock.
+	long items_over_limit = (zone->max_items_in_quarantine > 0 &&
+		zone->items_in_quarantine > zone->max_items_in_quarantine) ?
+		zone->items_in_quarantine - zone->max_items_in_quarantine : 0;
+	long bytes_over_limit = (zone->max_bytes_in_quarantine > 0 &&
+		zone->bytes_in_quarantine > zone->max_bytes_in_quarantine) ?
+		zone->bytes_in_quarantine - zone->max_bytes_in_quarantine : 0;
+
+	quarantined_chunk_t *items_to_free_head = zone->quarantine_head;
+	size_t items_to_free_count = 0;
+	size_t items_to_free_size = 0;
+
+	quarantined_chunk_t *iterator = zone->quarantine_head;
+	while (items_over_limit > 0 || bytes_over_limit > 0) {
+		next_and_size n;
+		n.i = _malloc_read_uint64_via_rsp(&iterator->next_and_size);
+		quarantined_chunk_t *next = __unsafe_forge_single(quarantined_chunk_t *, n.parts.next_ptr);
+		size_t iterator_size = n.parts.size;
+
+		items_to_free_count += 1;
+		items_to_free_size += iterator_size;
+		items_over_limit -= 1;
+		bytes_over_limit -= iterator_size;
+
+		iterator = next;
+	}
+
+	zone->quarantine_head = iterator;
+	zone->items_in_quarantine -= items_to_free_count;
+	zone->bytes_in_quarantine -= items_to_free_size;
+
+	unlock(zone);
+
+	// Actually free chunks. At this point, they are already removed from the
+	// quarantine list so we are the exclusive owner of them.
+	iterator = items_to_free_head;
+	for (size_t i = 0; i < items_to_free_count; i++) {
+		next_and_size n;
+		n.i = _malloc_read_uint64_via_rsp(&iterator->next_and_size);
+		quarantined_chunk_t *next = __unsafe_forge_single(quarantined_chunk_t *, n.parts.next_ptr);
+		size_t iterator_size = n.parts.size;
+
+		if (zone->debug) malloc_report(ASL_LEVEL_INFO, "evicting %p from quarantine, size = 0x%lx\n", iterator, iterator_size);
+
+		// Same as above, perform actual unpoisoning
+		if (zone->do_poisoning) {
+			unpoison(zone, iterator, iterator_size);
+		}
+
+		DELEGATE(free_definite_size, iterator, iterator_size);
+
+		iterator = next;
+	}
+}
+
+#if !MALLOC_TARGET_EXCLAVES
+#pragma mark -
+#pragma mark MurmurHash2
+
+// 32-bit MurmurHash2, public domain by Austin Appleby,
+// <https://github.com/aappleby/smhasher/blob/master/src/MurmurHash2.cpp>.
+
+#define MURMUR2_SEED 0xe3be96d1  // fair dice roll
+#define MURMUR2_MULTIPLIER 0x5bd1e995
+
+static uint32_t
+murmur2_init()
+{
+	return MURMUR2_SEED;
+}
+
+static void
+murmur2_add_uint32(uint32_t *hstate, uint32_t val)
+{
+	val *= MURMUR2_MULTIPLIER;
+	val ^= val >> 24;
+	val *= MURMUR2_MULTIPLIER;
+	*hstate *= MURMUR2_MULTIPLIER;
+	*hstate ^= val;
+}
+
+static void
+murmur2_add_uintptr(uint32_t *hstate, uintptr_t ptr)
+{
+	murmur2_add_uint32(hstate, (uint32_t)ptr);
+	murmur2_add_uint32(hstate, (uint32_t)(ptr >> 32));
+}
+
+static uint32_t
+murmur2_finalize(uint32_t *hstate)
+{
+	uint32_t X = *hstate;
+	X ^= X >> 13;
+	X *= MURMUR2_MULTIPLIER;
+	X ^= X >> 15;
+	return X;
+}
+
+static uint32_t
+murmur2_hash_pointer(uintptr_t ptr)
+{
+	uint32_t hstate = murmur2_init();
+	murmur2_add_uintptr(&hstate, ptr);
+	return murmur2_finalize(&hstate);
+}
+
+static uint32_t
+murmur2_hash_backtrace(uintptr_t * __counted_by(count) pcs, size_t count)
+{
+	uint32_t hstate = murmur2_init();
+	for (int i = 0; i < count; i++) {
+		murmur2_add_uintptr(&hstate, pcs[i]);
+	}
+	return murmur2_finalize(&hstate);
+}
+
+
+#pragma mark -
+#pragma mark Stack Trace Depo
+
+// Data structure to store up to 512k unique stacktraces, if they're on average
+// 8 frames large, barring hash collisions, loosely modelled after Scudo:
+// <https://github.com/llvm/llvm-project/blob/main/compiler-rt/lib/scudo/>.
+//
+// - The "handle" to a stored stacktrace is its own hash (Murmur2).
+// - Frames are stored in a ring buffer, oldest get replaced on wrap.
+// - Look-up will not return evicted data because we check the hash.
+// - Friendly for remote inspection by ReportCrash (no pointers).
+// - Lock-free, non-synchronizing insertion (no in-process look-ups).
+// - Racy same-hash insertion might store the frames twice, but that's fine.
+// - Hash collisions (murmur2 produces uint32_t hashes) will cause a stacktrace
+//   to be unique'd against a different one, and look-up can retrieve a wrong
+//   stacktrace. Should be rare enough with a good hashing algorithm, and it's
+//   fine given we store stacktraces only for diagnostic purposes.
+//
+// The sanitizer zone captures alloc and dealloc stack traces and saves them
+// into the depo. The handles/hashes are then stored elsewhere (in pointer_map
+// for live allocations, and in quarantine_chunk_t for quarantined ones).
+
+typedef struct stacktrace_depo_t {
+	uint64_t index[1 << 19];  // 512k entries, 4 MiB in size
+	uint64_t storage[1 << 22];  // 4m entries, 32 MiB in size
+	uint64_t storage_pos; // can be over countof(storage), always use wrap()
+} stacktrace_depo_t;
+
+typedef union {
+	uint64_t i;
+	struct {
+		uint32_t hash;
+		uint32_t pos : 24;
+		uint32_t count : 8;
+	} parts;
+} index_entry;
+MALLOC_STATIC_ASSERT(sizeof(index_entry) == 8, "index_entry should be 64 bits");
+
+static stacktrace_depo_t *
+stacktrace_depo_create()
+{
+	return mvm_allocate_pages(sizeof(stacktrace_depo_t), PAGE_SHIFT, 0, VM_MEMORY_ANALYSIS_TOOL);
+}
+
+static void
+stacktrace_depo_destroy(stacktrace_depo_t *depo)
+{
+	mvm_deallocate_pages(depo, sizeof(stacktrace_depo_t), 0);
+}
+
+static uint32_t
+stacktrace_depo_insert(stacktrace_depo_t *depo, uintptr_t * __counted_by(count) pcs, size_t count)
+{
+	MALLOC_ASSERT(count < 256);
+	uint32_t hash = murmur2_hash_backtrace(pcs, count);
+	uint32_t index_pos = wrap(hash, depo->index);
+
+	index_entry entry;
+	entry.i = os_atomic_load(&depo->index[index_pos], relaxed);
+	if (entry.parts.count == count && entry.parts.hash == hash) {
+		return hash;
+	}
+
+	uint64_t old_storage_pos = wrap(os_atomic_add_orig(&depo->storage_pos,
+			count, relaxed), depo->storage);
+	entry.parts.hash = hash;
+	entry.parts.pos = (uint32_t)old_storage_pos;
+	entry.parts.count = (uint32_t)count;
+	os_atomic_store(&depo->index[index_pos], entry.i, relaxed);
+	for (int i = 0; i < count; i++) {
+		uint32_t pos = wrap(old_storage_pos + i, depo->storage);
+		os_atomic_store(&depo->storage[pos], pcs[i], relaxed);
+	}
+	return hash;
+}
+
+// Doesn't need to use atomics or be thread-safe against insertion because
+// look-up is only used from ReportCrash against a corpse.
+static size_t
+stacktrace_depo_find(stacktrace_depo_t *depo, uint32_t hash, uintptr_t * __counted_by(max_size) pcs, size_t max_size)
+{
+	uint32_t index_pos = wrap(hash, depo->index);
+
+	index_entry entry;
+	entry.i = depo->index[index_pos];
+	if (entry.parts.hash != hash || entry.parts.pos > countof(depo->storage)) {
+		return 0;
+	}
+
+	uint32_t hstate = murmur2_init();
+	for (int i = 0; i < entry.parts.count; i++) {
+		uint32_t pos = wrap(entry.parts.pos + i, depo->storage);
+		if (i < max_size) {
+			pcs[i] = depo->storage[pos];
+		}
+		murmur2_add_uintptr(&hstate, pcs[i]);
+	}
+
+	if (hash != murmur2_finalize(&hstate)) {
+		return 0;
+	}
+
+	return MIN(max_size, entry.parts.count);
+}
+
+
+#pragma mark -
+#pragma mark Pointer Map
+
+// Data structure to associate and store a 64-bit value for arbitrary pointers.
+//
+// We use the pointer map to store handles/hashes of stacktraces for live heap
+// allocations. When the same pointer is inserted again, it must have already
+// been quarantined and free'd and recycled, so it's okay to drop the previous
+// data associated with it. On slot collision (20 bits), we evict the older
+// entry, in which case we just lose track of the associated allocation
+// stacktrace for the older allocation. When a chunk is quarantined, we transfer
+// the stacktrace handle into quarantine_chunk_t, so we no longer care about the
+// pointer map holding the right value for it. Look-up will never return a wrong
+// value, because it checks the pointer address in the storage.
+
+typedef struct pointer_map_t {
+	__uint128_t storage[1 << 20];  // 1m entries, 16 MiB in size
+} pointer_map_t;
+
+typedef union {
+	__uint128_t i;
+	struct {
+		uint64_t ptr;
+		uint64_t word;
+	} parts;
+} pointer_map_entry;
+
+MALLOC_STATIC_ASSERT(sizeof(pointer_map_entry) == 16, "pointer_map_entry should be 16 bytes");
+
+static pointer_map_t *
+pointer_map_create()
+{
+	return mvm_allocate_pages(sizeof(pointer_map_t), PAGE_SHIFT, 0, VM_MEMORY_ANALYSIS_TOOL);
+}
+
+static void
+pointer_map_destroy(pointer_map_t *map)
+{
+	mvm_deallocate_pages(map, sizeof(pointer_map_t), 0);
+}
+
+static void
+pointer_map_insert(pointer_map_t *map, uintptr_t ptr, uint64_t word)
+{
+	uint32_t hash = murmur2_hash_pointer(ptr);
+	uint32_t pos = wrap(hash, map->storage);
+	pointer_map_entry entry;
+	entry.parts.ptr = ptr;
+	entry.parts.word = word;
+	os_atomic_store_wide(&map->storage[pos], entry.i, relaxed);
+}
+
+static bool
+pointer_map_find(pointer_map_t *map, uintptr_t ptr, uint64_t *word_out)
+{
+	uint32_t hash = murmur2_hash_pointer(ptr);
+	uint32_t pos = wrap(hash, map->storage);
+	pointer_map_entry entry;
+	entry.i = os_atomic_load_wide(&map->storage[pos], relaxed);
+	if (entry.parts.ptr != ptr) {
+		return false;
+	}
+	*word_out = entry.parts.word;
+	return true;
+}
+#endif /* !MALLOC_TARGET_EXCLAVES */
+
+#pragma mark -
+#pragma mark Poisoning Functions
+
+// Size of redzone is stored in the last aligned size_t at the end of the allocation
+static size_t get_redzone_size(sanitizer_zone_t *zone, const void * __sized_by(size) ptr, size_t size)
+{
+	MALLOC_ASSERT(zone->do_poisoning);
+	// Size of redzone is stored in the last aligned size_t at the end of the allocation
+	const size_t offset = sizeof(size_t) + size % sizeof(size_t);
+	const size_t *redzone_size_ptr =
+			__unsafe_forge_single(size_t *, ((uintptr_t)ptr + size - offset));
+	// When executing under instrumentation, the translation layer automatically
+	// checks against the shadow map, instead of letting the compiled program's
+	// instrumentation handle it. This means we need to bypass it since the size
+	// is stored within the allocation redzone
+	const size_t redzone_size = _malloc_read_uint64_via_rsp(redzone_size_ptr);
+	MALLOC_ASSERT(redzone_size >= zone->redzone_size && redzone_size < size);
+	return redzone_size;
+}
+
+static void set_redzone_size(sanitizer_zone_t *zone, void * __sized_by(usr_size + redzone_size) ptr, size_t usr_size, size_t redzone_size)
+{
+	MALLOC_ASSERT(zone->do_poisoning);
+	const size_t offset =
+			sizeof(size_t) + (usr_size + redzone_size) % sizeof(size_t);
+	size_t *redzone_size_ptr = ptr + (usr_size + redzone_size - offset);
+	// Same as above, this may be a reallocation that has not yet been unpoisoned
+	_malloc_write_uint64_via_rsp(redzone_size_ptr, redzone_size);
+}
+
+static void poison_alloc(sanitizer_zone_t *zone, void * __sized_by(usr_size + redzone_size) ptr, size_t usr_size, size_t redzone_size)
+{
+	if (zone->debug) malloc_report(ASL_LEVEL_INFO, "poison_alloc(%p, 0x%lx, 0x%lx)\n", ptr, usr_size, redzone_size);
+
+	MALLOC_ASSERT(ptr);
+
+	// Always set the redzone size, even if we can't actually poison allocations
+	set_redzone_size(zone, ptr, usr_size, redzone_size);
+
+	const struct malloc_sanitizer_poison *sanitizer = malloc_sanitizer_get_functions();
+	if (sanitizer && sanitizer->heap_allocate_poison) {
+		(*sanitizer->heap_allocate_poison)((uintptr_t)ptr, 0, usr_size, redzone_size);
+	} else if (zone->debug) {
+		malloc_report(ASL_LEVEL_WARNING, "MallocSanitizerZone: Not poisoning allocation %p of size %lu with redzone size %lu due to missing pointers!\n", ptr, usr_size, redzone_size);
+	}
+}
+
+static void poison_free(sanitizer_zone_t *zone, void * __sized_by(size) ptr, size_t size)
+{
+	if (zone->debug) malloc_report(ASL_LEVEL_INFO, "poison_free(%p, 0x%lx)\n", ptr, size);
+
+	MALLOC_ASSERT(ptr);
+
+	const struct malloc_sanitizer_poison *sanitizer = malloc_sanitizer_get_functions();
+	if (sanitizer && sanitizer->heap_deallocate_poison) {
+		(*sanitizer->heap_deallocate_poison)((uintptr_t)ptr, size);
+	} else if (zone->debug) {
+		malloc_report(ASL_LEVEL_WARNING, "MallocSanitizerZone: Not poisoning deallocation %p of size %lu due to missing pointers!\n", ptr, size);
+	}
+}
+
+static void unpoison(sanitizer_zone_t *zone, void * __sized_by(size) ptr, size_t size)
+{
+	if (zone->debug) malloc_report(ASL_LEVEL_INFO, "unpoison(%p, 0x%lx)\n", ptr, size);
+
+	MALLOC_ASSERT(ptr);
+
+	const struct malloc_sanitizer_poison *sanitizer = malloc_sanitizer_get_functions();
+	if (sanitizer && sanitizer->heap_allocate_poison) {
+		(*sanitizer->heap_allocate_poison)((uintptr_t)ptr, 0, size, 0);
+	} else if (zone->debug) {
+		malloc_report(ASL_LEVEL_WARNING, "MallocSanitizerZone: Not unpoisoning %p of size %lu due to missing pointers!\n", ptr, size);
+	}
+}
+
+#pragma mark -
+#pragma mark Zone Functions
+
+static size_t
+sanitizer_size(sanitizer_zone_t *zone, const void * __unsafe_indexable ptr)
+{
+	size_t size = DELEGATE(size, ptr);
+	if (zone->do_poisoning) {
+		const size_t redzone_size = get_redzone_size(zone, __unsafe_forge_bidi_indexable(void *, ptr, size), size);
+		if (zone->debug) malloc_report(ASL_LEVEL_INFO, "size(%p) = 0x%lx - redzone 0x%lx\n", ptr, size, redzone_size);
+
+		MALLOC_ASSERT(size > redzone_size);
+		size -= redzone_size;
+	} else {
+		if (zone->debug) malloc_report(ASL_LEVEL_INFO, "size(%p) = 0x%lx\n", ptr, size);
+	}
+	return size;
+}
+
+static void * __alloc_size(2)
+sanitizer_malloc(sanitizer_zone_t *zone, size_t size)
+{
+	size_t redzone_size = zone->redzone_size;
+	const size_t usr_size = size;
+	if (zone->do_poisoning) {
+		const size_t mask = ASAN_SHADOW_ALIGNMENT - 1;
+		// Round up redzone so that allocation is padded to shadow alignment
+		redzone_size += (ASAN_SHADOW_ALIGNMENT - (usr_size & mask)) & mask;
+		// Recalculate the total allocation size
+		size = usr_size + redzone_size;
+		// Check for overflow once at the end
+		if (size < usr_size) {
+			malloc_set_errno_fast(MZ_POSIX, ENOMEM);
+			return NULL;
+		}
+	}
+	void *ptr = DELEGATE(malloc, size);
+#if !MALLOC_TARGET_EXCLAVES
+	record_alloc_stacktrace(zone->depo, zone->map, ptr, usr_size);
+#endif /* !MALLOC_TARGET_EXCLAVES */
+	if (zone->debug) malloc_report(ASL_LEVEL_INFO, "malloc(0x%lx) = %p\n", size, ptr);
+	if (ptr && zone->do_poisoning) {
+		// Recalculate the redzone size to include allocator padding
+		size_t actual_size = DELEGATE(size, ptr);
+		MALLOC_ASSERT(actual_size >= size);
+		redzone_size += actual_size - size;
+		ptr = __unsafe_forge_bidi_indexable(void *, ptr,
+				usr_size + redzone_size);
+		poison_alloc(zone, ptr, usr_size, redzone_size);
+	}
+	return ptr;
+}
+
+static void * __alloc_size(2,3)
+sanitizer_calloc(sanitizer_zone_t *zone, size_t num_items, size_t size)
+{
+	size_t usr_size;
+	if (calloc_get_size(num_items, size, 0, &usr_size)) {
+		malloc_set_errno_fast(MZ_POSIX, ENOMEM);
+		return NULL;
+	}
+
+	size_t redzone_size = zone->redzone_size;
+	if (zone->do_poisoning) {
+		// Round up redzone so that allocation is padded to shadow alignment
+		redzone_size += ASAN_SHADOW_ALIGNMENT - (usr_size & (ASAN_SHADOW_ALIGNMENT - 1));
+		// Recalculate the total allocation size
+		num_items = 1;
+		size = usr_size + redzone_size;
+		// Check for overflow once at the end
+		if (size < usr_size) {
+			malloc_set_errno_fast(MZ_POSIX, ENOMEM);
+			return NULL;
+		}
+	}
+	void *ptr = __unsafe_forge_bidi_indexable(void *, DELEGATE(calloc, num_items, size), usr_size);
+	if (zone->debug) malloc_report(ASL_LEVEL_INFO, "calloc(0x%lx, 0x%lx) = %p\n", num_items, size, ptr);
+#if !MALLOC_TARGET_EXCLAVES
+	record_alloc_stacktrace(zone->depo, zone->map, ptr, usr_size);
+#endif /* !MALLOC_TARGET_EXCLAVES */
+	if (ptr && zone->do_poisoning) {
+		// Recalculate the redzone size to include allocator padding
+		size_t actual_size = DELEGATE(size, ptr);
+		MALLOC_ASSERT(actual_size >= size);
+		redzone_size += actual_size - size;
+		ptr = __unsafe_forge_bidi_indexable(void *, ptr,
+				usr_size + redzone_size);
+		poison_alloc(zone, ptr, usr_size, redzone_size);
+	}
+	return ptr;
+}
+
+static void * __alloc_size(2)
+sanitizer_valloc(sanitizer_zone_t *zone, size_t size)
+{
+	size_t redzone_size = zone->redzone_size;
+	const size_t usr_size = size;
+	if (zone->do_poisoning) {
+		// Round up redzone so that allocation is padded to shadow alignment
+		redzone_size += ASAN_SHADOW_ALIGNMENT - (usr_size & (ASAN_SHADOW_ALIGNMENT - 1));
+		// Recalculate the total allocation size
+		size = usr_size + redzone_size;
+		// Check for overflow once at the end
+		if (size < usr_size) {
+			return NULL;
+		}
+	}
+	void *ptr = DELEGATE(valloc, size);
+#if !MALLOC_TARGET_EXCLAVES
+	record_alloc_stacktrace(zone->depo, zone->map, ptr, usr_size);
+#endif /* !MALLOC_TARGET_EXCLAVES */
+	if (zone->debug) malloc_report(ASL_LEVEL_INFO, "valloc(0x%lx) = %p\n", size, ptr);
+	if (ptr && zone->do_poisoning) {
+		// Recalculate the redzone size to include allocator padding
+		size_t actual_size = DELEGATE(size, ptr);
+		MALLOC_ASSERT(actual_size >= size);
+		redzone_size += actual_size - size;
+		ptr = __unsafe_forge_bidi_indexable(void *, ptr,
+				usr_size + redzone_size);
+		poison_alloc(zone, ptr, usr_size, redzone_size);
+	}
+	return ptr;
+}
+
+static void
+sanitizer_free(sanitizer_zone_t *zone, void * __unsafe_indexable ptr)
+{
+	size_t size = 0;
+	if (zone->do_poisoning) {
+		size = DELEGATE(size, ptr);
+		poison_free(zone, __unsafe_forge_bidi_indexable(void *, ptr, size), size);
+	}
+	if (zone->debug) malloc_report(ASL_LEVEL_INFO, "free(%p)\n", ptr);
+	place_into_quarantine(zone, ptr, size);
+}
+
+static void * __alloc_size(3)
+sanitizer_realloc(sanitizer_zone_t *zone, void * __unsafe_indexable ptr, size_t new_size)
+{
+	if (new_size == 0) {
+		new_size = 1;
+	}
+
+	size_t redzone_size = zone->redzone_size;
+	const size_t usr_new_size = new_size;
+	if (zone->do_poisoning) {
+		// Round up redzone so that allocation is padded to shadow alignment
+		redzone_size += ASAN_SHADOW_ALIGNMENT - (new_size & (ASAN_SHADOW_ALIGNMENT - 1));
+		// Recalculate the total allocation size
+		new_size = usr_new_size + redzone_size;
+		// Check for overflow once at the end
+		if (new_size < usr_new_size) {
+			return NULL;
+		}
+	}
+
+	void *new_ptr = DELEGATE(malloc, new_size);
+#if !MALLOC_TARGET_EXCLAVES
+	record_alloc_stacktrace(zone->depo, zone->map, new_ptr, usr_new_size);
+#endif /* !MALLOC_TARGET_EXCLAVES */
+	if (zone->debug) malloc_report(ASL_LEVEL_INFO, "realloc(%p, 0x%lx) = %p\n", ptr, new_size, new_ptr);
+
+	if (ptr != NULL) {
+		size_t old_redzone_size = 0;
+		const size_t old_size = DELEGATE(size, ptr);
+		void *old_ptr = __unsafe_forge_bidi_indexable(void *, ptr, old_size);
+		if (zone->do_poisoning) {
+			old_redzone_size = get_redzone_size(zone, old_ptr, old_size);
+			MALLOC_ASSERT(old_size > old_redzone_size);
+		}
+
+		if (zone->debug) malloc_report(ASL_LEVEL_INFO, "realloc(%p, 0x%lx): size(%p) = 0x%lx - redzone 0x%lx)\n", ptr, new_size, old_ptr, old_size, old_redzone_size);
+
+		// Don't free/quarantine the old pointer if allocation failed. Per man page:
+		// > For realloc(), the input pointer is still valid if reallocation failed.
+		if (new_ptr == NULL) {
+			return NULL;
+		}
+
+		const size_t usr_old_size = old_size - old_redzone_size;
+		memcpy(new_ptr, old_ptr, MIN(usr_old_size, usr_new_size));
+		if (zone->do_poisoning) {
+			poison_free(zone, old_ptr, old_size);
+		}
+		place_into_quarantine(zone, ptr, old_size);
+	}
+
+	if (new_ptr && zone->do_poisoning) {
+		// Recalculate the redzone size to include allocator padding
+		size_t actual_size = DELEGATE(size, new_ptr);
+		MALLOC_ASSERT(actual_size >= new_size);
+		redzone_size += actual_size - new_size;
+		new_ptr = __unsafe_forge_bidi_indexable(void *, new_ptr,
+				usr_new_size + redzone_size);
+		poison_alloc(zone, new_ptr, usr_new_size, redzone_size);
+	}
+	return new_ptr;
+}
+
+static void
+sanitizer_destroy(sanitizer_zone_t *zone)
+{
+#if !MALLOC_TARGET_EXCLAVES
+	stacktrace_depo_destroy(zone->depo);
+	pointer_map_destroy(zone->map);
+	malloc_destroy_zone(zone->wrapped_zone);
+	sanitizer_vm_deallocate((vm_address_t)zone, sizeof(sanitizer_zone_t));
+#else
+	(void)zone;
+#endif /* !MALLOC_TARGET_EXCLAVES */
+}
+
+static void * __alloc_align(2) __alloc_size(3)
+sanitizer_memalign(sanitizer_zone_t *zone, size_t alignment, size_t size)
+{
+	size_t redzone_size = zone->redzone_size;
+	const size_t usr_size = size;
+	if (zone->do_poisoning) {
+		// Recalculate the total allocation size
+		size = usr_size + redzone_size;
+		// Check for overflow once at the end
+		if (size < usr_size) {
+			return NULL;
+		}
+	}
+	void *ptr = DELEGATE(memalign, alignment, size);
+#if !MALLOC_TARGET_EXCLAVES
+	record_alloc_stacktrace(zone->depo, zone->map, ptr, usr_size);
+#endif /* !MALLOC_TARGET_EXCLAVES */
+	if (zone->debug) malloc_report(ASL_LEVEL_INFO, "memalign(0x%lx, 0x%lx)\n", alignment, size);
+	if (ptr && zone->do_poisoning) {
+		// Recalculate the redzone size to include allocator padding
+		size_t actual_size = DELEGATE(size, ptr);
+		MALLOC_ASSERT(actual_size >= size);
+		redzone_size += actual_size - size;
+		ptr = __unsafe_forge_bidi_indexable(void *, ptr,
+				usr_size + redzone_size);
+		poison_alloc(zone, ptr, usr_size, redzone_size);
+	}
+	return ptr;
+}
+
+static void
+sanitizer_free_definite_size(sanitizer_zone_t *zone, void * __sized_by(size) ptr, size_t size)
+{
+	if (zone->debug) malloc_report(ASL_LEVEL_INFO, "free_definite_size(%p, 0x%lx)\n", ptr, size);
+	if (zone->do_poisoning) {
+		// Provided size is the user accessible size, but we need the total size
+		const size_t actual_size = DELEGATE(size, ptr);
+		ptr = __unsafe_forge_bidi_indexable(void *, ptr, actual_size);
+		size = actual_size;
+		poison_free(zone, ptr, size);
+	}
+	place_into_quarantine(zone, ptr, size);
+}
+
+static size_t
+sanitizer_pressure_relief(sanitizer_zone_t *zone, size_t goal)
+{
+	return DELEGATE(pressure_relief, goal);
+}
+
+static bool
+sanitizer_claimed_address(sanitizer_zone_t *zone, void * __unsafe_indexable ptr)
+{
+	return DELEGATE(claimed_address, ptr);
+}
+
+#pragma mark -
+#pragma mark Introspection Functions
+
+static kern_return_t
+sanitizer_enumerator(task_t task, void *context, unsigned type_mask, vm_address_t zone_address, memory_reader_t reader, vm_range_recorder_t recorder)
+{
+	return KERN_NOT_SUPPORTED;
+}
+
+static void
+sanitizer_statistics(sanitizer_zone_t *zone, malloc_statistics_t *stats)
+{
+}
+
+static kern_return_t
+sanitizer_statistics_task(task_t task, vm_address_t zone_address, memory_reader_t reader, malloc_statistics_t *stats)
+{
+	return KERN_NOT_SUPPORTED;
+}
+
+static void
+sanitizer_print(sanitizer_zone_t *zone, bool verbose)
+{
+}
+
+static void
+sanitizer_print_task(task_t task, unsigned level, vm_address_t zone_address, memory_reader_t reader, print_task_printer_t printer)
+{
+}
+
+static void
+sanitizer_log(sanitizer_zone_t *zone, void *address)
+{
+}
+
+static size_t
+sanitizer_good_size(sanitizer_zone_t *zone, size_t size)
+{
+	return DELEGATE(introspect->good_size, size);
+}
+
+static bool
+sanitizer_check(sanitizer_zone_t *zone)
+{
+	return true; // Zone is always in a consistent state.
+}
+
+static void
+sanitizer_force_lock(sanitizer_zone_t *zone)
+{
+	lock(zone);
+}
+
+static void
+sanitizer_force_unlock(sanitizer_zone_t *zone)
+{
+	unlock(zone);
+}
+
+static void
+sanitizer_reinit_lock(sanitizer_zone_t *zone)
+{
+	init_lock(zone);
+}
+
+static bool
+sanitizer_zone_locked(sanitizer_zone_t *zone)
+{
+	bool lock_taken = trylock(zone);
+	if (lock_taken) {
+		unlock(zone);
+	}
+	return !lock_taken;
+}
+
+#if !MALLOC_TARGET_EXCLAVES
+#pragma mark -
+#pragma mark Crash Reporter API
+
+static _malloc_lock_s crash_reporter_lock = _MALLOC_LOCK_INIT;
+
+static crash_reporter_memory_reader_t g_crm_reader;
+static const uint32_t k_max_read_memory = 1024;
+static void *read_memory[k_max_read_memory];
+static uint32_t num_read_memory;
+
+static kern_return_t
+memory_reader_adapter(task_t task, vm_address_t address, vm_size_t size, void **local_memory)
+{
+	MALLOC_ASSERT(num_read_memory < k_max_read_memory);
+	void *ptr = g_crm_reader(task, address, size);
+	*local_memory = ptr;
+	read_memory[num_read_memory++] = ptr;
+	return ptr ? KERN_SUCCESS : KERN_FAILURE;
+}
+
+static struct {
+	vm_address_t address_to_lookup;
+	vm_range_t found_range;
+} enumeration_context;
+
+static void
+pointer_recorder(task_t task, void *context, unsigned type, vm_range_t * __counted_by(count) ranges, unsigned count)
+{
+	vm_address_t a = enumeration_context.address_to_lookup;
+	for (int i = 0; i < count; i++) {
+		if (ranges[i].address <= a && a < ranges[i].address + ranges[i].size) {
+			enumeration_context.found_range = ranges[i];
+			break;
+		}
+	}
+}
+
+kern_return_t
+sanitizer_diagnose_fault_from_crash_reporter(vm_address_t fault_address, sanitizer_report_t *report,
+		task_t task, vm_address_t zone_address, crash_reporter_memory_reader_t crm_reader)
+{
+	_malloc_lock_lock(&crash_reporter_lock);
+
+	#define COPY_FROM_REMOTE(p, type) crm_reader(task, (vm_address_t)p, sizeof(type))
+	sanitizer_zone_t *remote_zone = COPY_FROM_REMOTE(zone_address, sanitizer_zone_t);
+	pointer_map_t *remote_pointer_map = COPY_FROM_REMOTE(remote_zone->map, pointer_map_t);
+	stacktrace_depo_t *remote_depo = COPY_FROM_REMOTE(remote_zone->depo, stacktrace_depo_t);
+
+	enumeration_context.found_range.address = 0;
+	enumeration_context.found_range.size = 0;
+	enumeration_context.address_to_lookup = fault_address;
+
+	g_crm_reader = crm_reader;
+	num_read_memory = 0;
+
+	// We rely on being able to perform zone enumeration across different architecture slices on macOS.
+	// On Apple Silicon Macs, ReportCrash is always running as a native (arm64e) process, but we also
+	// need to be able to inspect x86_64 targets that are running under Rosetta. So the data layout and
+	// zone logic needs to match between x86_64 and arm64(e).
+	szone_introspect.enumerator(task, NULL, MALLOC_PTR_IN_USE_RANGE_TYPE, (vm_address_t)remote_zone->wrapped_zone,
+								memory_reader_adapter, pointer_recorder);
+	for (uint32_t i = 0; i < num_read_memory; i++) {
+		_free(read_memory[i]);
+	}
+	g_crm_reader = NULL;
+
+	memset(report, 0, sizeof(*report));
+	report->fault_address = fault_address;
+
+	if (enumeration_context.found_range.address != 0) {
+		report->nearest_allocation = enumeration_context.found_range.address;
+		report->allocation_size = enumeration_context.found_range.size;
+
+		quarantined_chunk_t *chunk = COPY_FROM_REMOTE(enumeration_context.found_range.address, quarantined_chunk_t);
+		uint32_t alloc_handle = (uint32_t)chunk->stacktrace_hashes;
+		uint32_t dealloc_handle = (uint32_t)(chunk->stacktrace_hashes >> 32);
+
+		report->alloc_trace.thread_id = 0;
+		report->alloc_trace.num_frames = (uint32_t)stacktrace_depo_find(remote_depo, alloc_handle,
+				report->alloc_trace.frames, countof(report->alloc_trace.frames));
+
+		report->dealloc_trace.thread_id = 0;
+		report->dealloc_trace.num_frames = (uint32_t)stacktrace_depo_find(remote_depo, dealloc_handle,
+				report->dealloc_trace.frames, countof(report->dealloc_trace.frames));
+
+		_free(chunk);
+	}
+
+	_free(remote_depo);
+	_free(remote_pointer_map);
+	_free(remote_zone);
+
+	_malloc_lock_unlock(&crash_reporter_lock);
+	return KERN_SUCCESS;
+}
+#endif /* !MALLOC_TARGET_EXCLAVES */
+
+#pragma mark -
+#pragma mark Zone Templates
+
+// Suppress warning: incompatible function pointer types
+#define FN_PTR(fn) (void *)(&fn)
+
+static malloc_introspection_t sanitizer_zone_introspect_template = {
+	// Block and region enumeration
+	.enumerator = FN_PTR(sanitizer_enumerator),
+
+	// Statistics
+	.statistics = FN_PTR(sanitizer_statistics),
+	.task_statistics = FN_PTR(sanitizer_statistics_task),
+
+	// Logging
+	.print = FN_PTR(sanitizer_print),
+	.print_task = FN_PTR(sanitizer_print_task),
+	.log = FN_PTR(sanitizer_log),
+
+	// Queries
+	.good_size = FN_PTR(sanitizer_good_size),
+	.check = FN_PTR(sanitizer_check),
+
+	// Locking
+	.force_lock = FN_PTR(sanitizer_force_lock),
+	.force_unlock = FN_PTR(sanitizer_force_unlock),
+	.reinit_lock = FN_PTR(sanitizer_reinit_lock),
+	.zone_locked = FN_PTR(sanitizer_zone_locked),
+
+	// Discharge checking
+	.enable_discharge_checking = NULL,
+	.disable_discharge_checking = NULL,
+	.discharge = NULL,
+#ifdef __BLOCKS__
+	.enumerate_discharged_pointers = NULL,
+#else
+	.enumerate_unavailable_without_blocks = NULL,
+#endif
+
+	// Zone type
+	.zone_type = MALLOC_ZONE_TYPE_SANITIZER,
+};
+
+static const malloc_zone_t malloc_zone_template = {
+	// Reserved for CFAllocator
+	.reserved1 = NULL,
+	.reserved2 = NULL,
+
+	// Standard operations
+	.size = FN_PTR(sanitizer_size),
+	.malloc = FN_PTR(sanitizer_malloc),
+	.calloc = FN_PTR(sanitizer_calloc),
+	.valloc = FN_PTR(sanitizer_valloc),
+	.free = FN_PTR(sanitizer_free),
+	.realloc = FN_PTR(sanitizer_realloc),
+	.destroy = FN_PTR(sanitizer_destroy),
+
+	// Batch operations
+	.batch_malloc = malloc_zone_batch_malloc_fallback,
+	.batch_free = malloc_zone_batch_free_fallback,
+
+	// Introspection
+	.zone_name = "SanitizerMallocZone",
+	.version = 14,
+	.introspect = &sanitizer_zone_introspect_template,
+
+	// Specialized operations
+	.memalign = FN_PTR(sanitizer_memalign),
+	.free_definite_size = FN_PTR(sanitizer_free_definite_size),
+	.pressure_relief = FN_PTR(sanitizer_pressure_relief),
+	.claimed_address = FN_PTR(sanitizer_claimed_address),
+	.try_free_default = NULL,
+};
+
+
+#pragma mark -
+#pragma mark Zone Configuration & Creation
+
+bool
+sanitizer_should_enable(void)
+{
+#if !MALLOC_TARGET_EXCLAVES
+	return env_bool("MallocSanitizerZone") || env_bool("MallocQuarantineZone");
+#elif __LIBLIBC_F_ASAN_INSTRUMENTATION
+	return true;
+#else
+	return false;
+#endif /* !MALLOC_TARGET_EXCLAVES */
+}
+
+void
+sanitizer_reset_environment(void)
+{
+#if !MALLOC_TARGET_EXCLAVES
+	// Unset MallocSanitizerZone from the environment to avoid propagating it
+	// to any child processes (posix_spawn, exec, fork).
+	unsetenv("MallocSanitizerZone");
+	unsetenv("MallocQuarantineZone");
+#endif /* !MALLOC_TARGET_EXCLAVES */
+}
+
+malloc_zone_t *
+sanitizer_create_zone(malloc_zone_t *wrapped_zone)
+{
+#if !MALLOC_TARGET_EXCLAVES
+	sanitizer_zone_t *zone = __unsafe_forge_single(sanitizer_zone_t *,
+		sanitizer_vm_map(sizeof(sanitizer_zone_t), VM_PROT_READ | VM_PROT_WRITE,
+			VM_MEMORY_MALLOC));
+#else
+	sanitizer_zone_t *zone = &sanitizer_zone;
+#endif /* !MALLOC_TARGET_EXCLAVES */
+	zone->malloc_zone = malloc_zone_template;
+
+#if !MALLOC_TARGET_EXCLAVES
+	// Since we are calling szone_introspect.enumerator directly, see
+	// sanitizer_diagnose_fault_from_crash_reporter.
+	MALLOC_ASSERT(wrapped_zone->introspect == &szone_introspect);
+#endif /* !MALLOC_TARGET_EXCLAVES */
+	zone->wrapped_zone = wrapped_zone;
+
+	if (wrapped_zone->version < 13) {
+		malloc_report(MALLOC_REPORT_CRASH,
+				"Unsupported wrapped zone version: %u\n",
+				wrapped_zone->version);
+	}
+
+#if !MALLOC_TARGET_EXCLAVES
+	zone->debug = env_bool("MallocSanitizerZoneDebug");
+	zone->do_poisoning = !env_bool("MallocSanitizerNoPoisoning");
+	zone->redzone_size = env_uint("MallocSanitizerRedzoneSize", 16); // default is 16 bytes
+#else
+	zone->debug = false;
+	zone->do_poisoning = true;
+	zone->redzone_size = 16;
+#endif /* !MALLOC_TARGET_EXCLAVES */
+	MALLOC_ASSERT((zone->redzone_size % ASAN_SHADOW_ALIGNMENT) == 0);
+#if !MALLOC_TARGET_EXCLAVES
+	zone->max_items_in_quarantine = env_uint("MallocQuarantineMaxItems", 0); // default is 0 = unlimited
+	zone->max_bytes_in_quarantine = (size_t)env_uint("MallocQuarantineMaxSizeInMB", 256) << 20; // 256 MB is default
+#else
+	zone->max_items_in_quarantine = 0;
+	zone->max_bytes_in_quarantine = 256 << 20;
+#endif /* !MALLOC_TARGET_EXCLAVES */
+
+#if !MALLOC_TARGET_EXCLAVES
+	zone->depo = stacktrace_depo_create();
+	zone->map = pointer_map_create();
+#endif /* !MALLOC_TARGET_EXCLAVES */
+
+	// Init mutable state
+	init_lock(zone);
+#if !MALLOC_TARGET_EXCLAVES
+	sanitizer_vm_protect((vm_address_t)zone, PAGE_MAX_SIZE, VM_PROT_READ);
+#endif /* !MALLOC_TARGET_EXCLAVES */
+	return __unsafe_forge_single(malloc_zone_t *, zone);
+}
+
+#else // CONFIG_SANITIZER
+
+kern_return_t
+sanitizer_diagnose_fault_from_crash_reporter(vm_address_t fault_address, sanitizer_report_t *report,
+		task_t task, vm_address_t zone_address, crash_reporter_memory_reader_t crm_reader)
+{
+	return KERN_NOT_SUPPORTED;
+}
+
+#endif // CONFIG_SANITIZER