--- libmalloc/libmalloc-792.60.6/private/malloc_private.h
+++ libmalloc/libmalloc-646.0.13/private/malloc_private.h
@@ -40,9 +40,9 @@
 
 #if !TARGET_OS_EXCLAVECORE && !TARGET_OS_EXCLAVEKIT
 /* Memorypressure notification mask to use by default */
-extern unsigned long malloc_memorypressure_mask_default_4libdispatch;
+extern const unsigned long malloc_memorypressure_mask_default_4libdispatch;
 /* Memorypressure notification mask to use if MSL has been enabled */
-extern unsigned long malloc_memorypressure_mask_msl_4libdispatch;
+extern const unsigned long malloc_memorypressure_mask_msl_4libdispatch;
 #endif // !TARGET_OS_EXCLAVECORE && !TARGET_OS_EXCLAVEKIT
 
 /*********	Callbacks	************/
@@ -105,7 +105,7 @@
  */
 #if !TARGET_OS_EXCLAVECORE && !TARGET_OS_EXCLAVEKIT
 SPI_AVAILABLE(macos(14.3), ios(17.4), tvos(17.4), watchos(10.4),
-		driverkit(23.4), visionos(1.1))
+		driverkit(23.4), xros(1.1))
 int malloc_engaged_secure_allocator(void) __result_use_check;
 #endif
 
@@ -142,7 +142,6 @@
 	uintptr_t DisableExpensiveDebuggingOptions : 1;
 	uintptr_t DisableProbabilisticGuardMalloc : 1;
 	uintptr_t DisableMallocStackLogging : 1;
-	uintptr_t ReservedFlag : 1;
 } malloc_thread_options_t;
 
 #if !TARGET_OS_EXCLAVECORE && !TARGET_OS_EXCLAVEKIT
@@ -232,27 +231,53 @@
 
 /****** Malloc with flags ******/
 
-typedef malloc_zone_malloc_options_t malloc_options_np_t;
-#define MALLOC_NP_OPTION_CLEAR MALLOC_ZONE_MALLOC_OPTION_CLEAR
-#define MALLOC_OPTIONS_NP_DEFAULT_ALIGN (sizeof(void *))
-
+OS_OPTIONS(malloc_options_np, uint64_t,
+	MALLOC_NP_OPTION_CLEAR = 0x1,
+);
 
 #if defined(__LP64__) // MALLOC_TARGET_64BIT
 /*!
+ * @function malloc_type_zone_malloc_with_options_np
+ *
+ * @discussion
+ * When malloc_zone_malloc_with_options_np was introduced, the TMO inferrence
+ * argument index was incorrectly set to the 4th argument (options). As such,
+ * TMO rewritten callsites will put the type descriptor in the 5th argument,
+ * instead of the 4th. To avoid revlocking and potential bincompat issues, we're
+ * leaving this symbol (_with_options_np) in the dylib with the type_id in the
+ * fifth argument, and adding the corrected symbol under a different name.
+ *
+ * This symbol will be deleted at some point in the future when no software is
+ * calling through it.
+ */
+SPI_DEPRECATED("Do not call through typed entrypoint directly",
+		macos(14.3, 15.0), ios(17.4, 18.0), tvos(17.4, 18.0),
+		watchos(10.4, 11.0), driverkit(23.4, 24.0), xros(1.1, 2.0))
+void * __sized_by_or_null(size) malloc_type_zone_malloc_with_options_np(
+		malloc_zone_t *zone, size_t align, size_t size,
+		malloc_options_np_t options, malloc_type_id_t desc) __result_use_check
+#if defined(__has_attribute) && __has_attribute(diagnose_if)
+__attribute__((__diagnose_if__(align & (align-1),
+		"alignment should be 0 or a power of 2", "error")))
+__attribute__((__diagnose_if__(align && (size % align),
+		"size should be an integral multiple of align", "error")))
+#endif
+		__alloc_size(3) __alloc_align(2);
+
+/*!
  * @function malloc_type_zone_malloc_with_options_internal
  *
  * @discussion
- * This function shouldn't be called directly, it is the deprecated rewrite
- * target for the corrected symbol with the type_id in the fourth argument.
- */
-SPI_DEPRECATED_WITH_REPLACEMENT("malloc_type_zone_malloc_with_options",
-		macos(15.0,16.0), ios(18.0,19.0), tvos(18.0,19.0), watchos(11.0,12.0),
-		driverkit(24.0,25.0), visionos(2.0,3.0))
+ * This function shouldn't be called directly, the declaration is an
+ * implementation detail for malloc_zone_malloc_with_options_np
+ */
+SPI_AVAILABLE(macos(15.0), ios(18.0), tvos(18.0), watchos(11.0),
+		driverkit(24.0), xros(2.0))
 void * __sized_by_or_null(size) malloc_type_zone_malloc_with_options_internal(
 		malloc_zone_t *zone, size_t align, size_t size,
 		malloc_type_id_t desc, malloc_options_np_t options) __result_use_check
 #if defined(__has_attribute) && __has_attribute(diagnose_if)
-__attribute__((__diagnose_if__(align && (align & (align-1)),
+__attribute__((__diagnose_if__(align & (align-1),
 		"alignment should be 0 or a power of 2", "error")))
 __attribute__((__diagnose_if__(align && (size % align),
 		"size should be an integral multiple of align", "error")))
@@ -263,17 +288,36 @@
 /*!
  * @function malloc_zone_malloc_with_options_np
  *
+ * @param zone
+ * The malloc zone that should be used to used to serve the allocation. This
+ * parameter may be NULL, in which case the default zone will be used.
+ *
+ * @param align
+ * The minimum alignment of the requested allocation. This parameter must be
+ * zero to request no particular alignment, or a power of 2 >= sizeof(void *).
+ *
+ * @param size
+ * The size, in bytes, of the requested allocation. Must be an integral multiple
+ * of align if align is non-zero.
+ *
+ * @param options
+ * A bitmask of options defining how the memory should be allocated. See the
+ * available bit values in the malloc_options_np_t enum definition.
+ *
+ * @result
+ * A pointer to the newly allocated block of memory, or NULL if the allocation
+ * failed.
+ *
  * @discussion
- * This function shouldn't be called directly, it is a deprecated SPI.
- */
-SPI_DEPRECATED_WITH_REPLACEMENT("malloc_zone_malloc_with_options",
-		macos(14.3,16.0), ios(17.4,19.0), tvos(17.4,19.0), watchos(10.4,12.0),
-		driverkit(23.4,25.0), visionos(1.1,3.0))
+ * This SPI does not set errno on all codepaths when the allocation fails.
+ */
+SPI_AVAILABLE(macos(14.3), ios(17.4), tvos(17.4), watchos(10.4),
+		driverkit(23.4), xros(1.1))
 void * __sized_by_or_null(size) malloc_zone_malloc_with_options_np(
 		malloc_zone_t *zone, size_t align, size_t size,
 		malloc_options_np_t options) __result_use_check
 #if defined(__has_attribute) && __has_attribute(diagnose_if)
-__attribute__((__diagnose_if__(align && (align & (align-1)),
+__attribute__((__diagnose_if__(align & (align-1),
 		"alignment should be 0 or a power of 2", "error")))
 __attribute__((__diagnose_if__(align && (size % align),
 		"size should be an integral multiple of align", "error")))
@@ -284,14 +328,9 @@
 #if !TARGET_OS_EXCLAVECORE && !TARGET_OS_EXCLAVEKIT
 // Indicates whether the libmalloc debug dylib is in use in the current process
 SPI_AVAILABLE(macos(14.3), ios(17.4), tvos(17.4), watchos(10.4),
-		driverkit(23.4), visionos(1.1))
+		driverkit(23.4), xros(1.1))
 bool
 malloc_variant_is_debug_4test(void);
-
-// Indicates whether libmalloc internal security policy is enabled in the
-// current process
-bool
-malloc_allows_internal_security_4test(void);
 #endif /* !TARGET_OS_EXCLAVECORE && !TARGET_OS_EXCLAVEKIT */
 
 __END_DECLS