[demrom]

When pthread_create fails, createOwnedCommand calls cleanup_function before run_function initializes the signal snapshot pointers. Cleanup frees each pointer and can abort (ios_system.m, the signal snapshot cleanup loop). Zero-initialize functionParameters before it reaches any cleanup path.

The arm64 Simulator regression uses Xcode 27.1 and a Release framework build. It forces one EAGAIN through an external thread-creation interposer with both MallocScribble and MallocPreScribble enabled. Master aborts with status 134; the fix returns 126, preserves the caller's streams and signal handler, and runs the next command with exact NEXT\n output.

An a-Shell build with this change passes normal command, file, pipeline, exit-status and background io.popen checks on an iPhone, with the same results as the unchanged build. The phone run does not inject a thread-creation failure.

[holzschu]

I may be missing something obvious, but I'm not seeing what this PR changes in the ios_system.m code. I see just one change where malloc is replaced with calloc(1,...) and two changes in the comments.

[demrom]

You're not missing anything: the fix is that one line. params came from malloc, so its signal snapshot pointers held whatever was in that memory. When pthread_create fails, cleanup_function runs before run_function has set them and frees each one, which aborts (status 134 in the test, with MallocScribble). With calloc they are NULL, so the cleanup is safe and the command returns 126. The two comments said "malloc'ed", which stopped being true. The rest of the PR is the regression test in tests/.

[holzschu]

Thanks for the explanation, and for catching that one.