--- libmalloc/libmalloc-317.121.1/private/malloc_private.h
+++ libmalloc/libmalloc-425.100.7/private/malloc_private.h
@@ -27,7 +27,11 @@
 /* Here be dragons (SPIs) */
 
 #include <mach/boolean.h>
+#include <mach/kern_return.h>
+#include <mach/mach_types.h>
 #include <sys/cdefs.h>
+#include <stddef.h>
+#include <stdint.h>
 #include <Availability.h>
 #include <os/availability.h>
 #include <malloc/malloc.h>
@@ -76,16 +80,48 @@
 API_AVAILABLE(macos(10.14), ios(12.0), tvos(12.0), watchos(5.0))
 int malloc_engaged_nano(void) __result_use_check;
 
+/*
+ * Disables zero-on-free in a process.  This has security implications and is
+ * intended to be used only as part of binary compatibility workarounds for
+ * external code.  It should be called as early as possible in the process
+ * lifetime, ideally before the process has gone multithreaded.  It is not
+ * guaranteed to have any effect.
+ */
+SPI_AVAILABLE(macos(13.0), ios(16.1), tvos(16.1), watchos(9.1))
+void malloc_zero_on_free_disable(void);
 
-/********* PGuard ************/
+/****** Thread-specific libmalloc options ******/
 
-const static uint32_t k_pguard_trace_max_frames = 16;
+/**
+ * Options struct: zero means "default options".
+ */
+typedef struct {
+	uintptr_t DisableExpensiveDebuggingOptions : 1;
+	uintptr_t DisableProbabilisticGuardMalloc : 1;
+	uintptr_t DisableMallocStackLogging : 1;
+} malloc_thread_options_t;
+
+API_AVAILABLE(macos(13.0), ios(16.0), tvos(16.0), watchos(9.0))
+malloc_thread_options_t malloc_get_thread_options(void) __result_use_check;
+
+API_AVAILABLE(macos(13.0), ios(16.0), tvos(16.0), watchos(9.0))
+void malloc_set_thread_options(malloc_thread_options_t opts);
+
+/****** Crash Reporter integration ******/
 
 typedef struct {
 	uint64_t thread_id;
+	uint64_t time;
 	uint32_t num_frames;
-	vm_address_t frames[k_pguard_trace_max_frames];
+	vm_address_t frames[64];
 } stack_trace_t;
+
+/**
+ * Like memory_reader_t, but caller must free returned memory if not NULL.
+ */
+typedef void *(*crash_reporter_memory_reader_t)(task_t task, vm_address_t address, size_t size);
+
+/****** Probabilistic Guard Malloc ******/
 
 typedef struct {
 	// diagnose_page_fault
@@ -97,18 +133,25 @@
 	size_t allocation_size;
 	const char *allocation_state;
 	uint32_t num_traces;
+	// fill_in_trace
 	stack_trace_t alloc_trace;
 	stack_trace_t dealloc_trace;
-} pguard_report_t;
-typedef pguard_report_t pgm_report_t;
+} pgm_report_t;
 
-/**
- * Like memory_reader_t, but caller must free returned memory if not NULL.
- */
-typedef void *(*crash_reporter_memory_reader_t)(task_t task, vm_address_t address, size_t size);
+kern_return_t pgm_diagnose_fault_from_crash_reporter(vm_address_t fault_address, pgm_report_t *report,
+		task_t task, vm_address_t zone_address, crash_reporter_memory_reader_t crm_reader) __result_use_check;
 
-API_AVAILABLE(macos(10.16), ios(14.0), tvos(14.0), watchos(7.0))
-kern_return_t pgm_diagnose_fault_from_crash_reporter(vm_address_t fault_address, pgm_report_t *report,
+/****** Quarantine Zone ******/
+
+typedef struct {
+	vm_address_t fault_address;
+	vm_address_t nearest_allocation;
+	size_t allocation_size;
+	stack_trace_t alloc_trace;
+	stack_trace_t dealloc_trace;
+} quarantine_report_t;
+
+kern_return_t quarantine_diagnose_fault_from_crash_reporter(vm_address_t fault_address, quarantine_report_t *report,
 		task_t task, vm_address_t zone_address, crash_reporter_memory_reader_t crm_reader) __result_use_check;