--- libmalloc/libmalloc-657.60.21/src/magazine_zone.h
+++ libmalloc/libmalloc-374.40.6/src/magazine_zone.h
@@ -23,9 +23,6 @@
 
 #ifndef __MAGAZINE_ZONE_H
 #define __MAGAZINE_ZONE_H
-
-#include <malloc/_ptrcheck.h>
-__ptrcheck_abi_assume_single()
 
 /*********************	DEFINITIONS	************************/
 
@@ -45,7 +42,7 @@
 
 // In-place free list entry. Unlike the out-of-band entry, the in-place entries
 // are stored at the start of the range that has been freed.
-typedef struct _inplace_free_entry_s * __single inplace_free_entry_t;
+typedef struct _inplace_free_entry_s *inplace_free_entry_t;
 
 typedef struct {
 	void *ptr;
@@ -60,7 +57,7 @@
 typedef struct _inplace_free_entry_s {
 	inplace_union previous;
 	inplace_union next;
-} inplace_free_entry_s, * __single inplace_free_entry_t;
+} inplace_free_entry_s, *inplace_free_entry_t;
 
 #ifdef __LP64__
 MALLOC_STATIC_ASSERT(sizeof(inplace_free_entry_s) == 16, "inplace free list must be 16-bytes long");
@@ -93,6 +90,10 @@
 
 typedef unsigned int grain_t; // N.B. wide enough to index all free slots
 
+#define CHECK_REGIONS (1 << 31)
+#define DISABLE_ASLR (1 << 30)
+#define DISABLE_LARGE_ASLR (1 << 29)
+
 #define MAX_RECORDER_BUFFER 256
 
 /*********************	DEFINITIONS for tiny	************************/
@@ -131,11 +132,6 @@
  * their size in the block, and store it both after the 'next' pointer, and in
  * the last 2 bytes of the block.
  *
- * With zero-on-free, free blocks of two or more quanta are zeroed out after
- * their leading inline metadata.  This invariant is maintained when blocks are
- * split and coalesced, enabling calloc(3) to return free blocks as-is after
- * clearing the metadata.
- *
  * 1-quantum block
  * Offset (32-bit mode)	(64-bit mode)
  * 0x0          0x0      : previous
@@ -147,7 +143,6 @@
  * 0x0          0x0      : previous
  * 0x4          0x08     : next
  * 0x8          0x10     : size (in quantum counts)
- * 0xa          0x12     : start of zeroed body
  * end - 2      end - 2  : size (in quantum counts)
  * end          end
  *
@@ -189,12 +184,12 @@
  * Beginning and end pointers for a region's heap.
  */
 #define TINY_REGION_HEAP_BASE(region) ((void *)(((tiny_region_t)region)->blocks))
-#define TINY_REGION_HEAP_END(region) __unsafe_forge_single(void *, ((uintptr_t)TINY_REGION_HEAP_BASE(region)) + TINY_HEAP_SIZE)
+#define TINY_REGION_HEAP_END(region) ((void *)(((uintptr_t)TINY_REGION_HEAP_BASE(region)) + TINY_HEAP_SIZE))
 
 /*
  * Locate the region for a pointer known to be within a tiny region.
  */
-#define TINY_REGION_FOR_PTR(ptr) __unsafe_forge_single(tiny_region_t, (uintptr_t)(ptr) & ~((1 << TINY_BLOCKS_ALIGN) - 1))
+#define TINY_REGION_FOR_PTR(ptr) ((tiny_region_t)((uintptr_t)(ptr) & ~((1 << TINY_BLOCKS_ALIGN) - 1)))
 
 /*
  * Convert between byte and msize units.
@@ -419,7 +414,7 @@
 /*
  * Locate the heap base for a pointer known to be within a small region.
  */
-#define SMALL_REGION_FOR_PTR(ptr) __unsafe_forge_single(small_region_t, (uintptr_t)(ptr) & ~((1 << SMALL_BLOCKS_ALIGN) - 1))
+#define SMALL_REGION_FOR_PTR(ptr) ((small_region_t)((uintptr_t)(ptr) & ~((1 << SMALL_BLOCKS_ALIGN) - 1)))
 #define SMALL_REGION_OFFSET_FOR_PTR(ptr) ((uintptr_t)(ptr) & ((1 << SMALL_BLOCKS_ALIGN) - 1))
 
 /*
@@ -623,7 +618,7 @@
 /*
  * Locate the heap base for a pointer known to be within a medium region.
  */
-#define MEDIUM_REGION_FOR_PTR(ptr) __unsafe_forge_single(void *, (uintptr_t)(ptr) & ~((1ull << MEDIUM_BLOCKS_ALIGN) - 1))
+#define MEDIUM_REGION_FOR_PTR(ptr) ((void *)((uintptr_t)(ptr) & ~((1ull << MEDIUM_BLOCKS_ALIGN) - 1)))
 #define MEDIUM_REGION_OFFSET_FOR_PTR(ptr) ((uintptr_t)(ptr) & ((1ull << MEDIUM_BLOCKS_ALIGN) - 1))
 
 /*
@@ -735,11 +730,7 @@
 typedef struct large_entry_s {
 	vm_address_t address;
 	vm_size_t size;
-#if CONFIG_DEFERRED_RECLAIM
-	uint64_t reclaim_index;
-#else
 	boolean_t did_madvise_reusable;
-#endif /* CONFIG_DEFERRED_RECLAIM */
 } large_entry_t;
 
 #if !CONFIG_LARGE_CACHE && DEBUG_MALLOC
@@ -785,7 +776,7 @@
 	// Take magazine_lock first,  Depot lock when needed for recirc, then szone->{tiny,small}_regions_lock when needed for alloc
 	_malloc_lock_s magazine_lock MALLOC_CACHE_ALIGN;
 	// Protection for the crtical section that does allocate_pages outside the magazine_lock
-	_malloc_lock_s magazine_alloc_lock;
+	volatile boolean_t alloc_underway;
 
 	// One element deep "death row", optimizes malloc/free/malloc for identical size.
 	void *mag_last_free;