diff --git a/pkgs/development/compilers/llvm/3.7/llvm.nix b/pkgs/development/compilers/llvm/3.7/llvm.nix
index cc65c69927c5..ae9ba62a04ce 100644
--- a/pkgs/development/compilers/llvm/3.7/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.7/llvm.nix
@@ -35,6 +35,18 @@ in stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ ncurses zlib ];
 
+  # The goal here is to disable LLVM bindings (currently go and ocaml) regardless
+  # of whether the impure CMake search sheananigans find the compilers in global
+  # paths. This mostly exists because sandbox builds don't work very well on Darwin
+  # and sometimes you get weird behavior if CMake finds go in your system path.
+  # This would be far prettier if there were a CMake option to just disable bindings
+  # but from what I can tell, there isn't such a thing. The file in question only
+  # contains `if(WIN32)` conditions to check whether to disable bindings, so making
+  # those always succeed has the net effect of disabling all bindings.
+  prePatch = ''
+    substituteInPlace cmake/config-ix.cmake --replace "if(WIN32)" "if(1)"
+  '';
+
   # hacky fix: created binaries need to be run before installation
   preBuild = ''
     mkdir -p $out/
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 27d2360a9800..aac213bb8047 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -56,9 +56,40 @@ appleDerivation rec {
     # The startup object files
     cp ${Csu}/lib/* $out/lib
 
-    # OMG impurity
-    ln -s /usr/lib/libSystem.B.dylib $out/lib/libSystem.B.dylib
-    ln -s /usr/lib/libSystem.dylib $out/lib/libSystem.dylib
+    # Narrowly speaking, these would work if we re-exported libsystem_c and libsystem_kernel,
+    # but we also need to run the original central libsystem constructor (which initializes
+    # a ton of crap for its consitutent libraries) so we link against the central library here.
+    mkdir -p $out/lib/system
+    ld -macosx_version_min 10.7 -arch x86_64 -dylib \
+       -o $out/lib/system/libsystem_c.dylib \
+       /usr/lib/libSystem.dylib \
+       -reexported_symbols_list ${./system_c_symbols}
+
+    ld -macosx_version_min 10.7 -arch x86_64 -dylib \
+       -o $out/lib/system/libsystem_kernel.dylib \
+       /usr/lib/libSystem.dylib \
+       -reexported_symbols_list ${./system_kernel_symbols}
+
+    libs=$(otool -arch x86_64 -L /usr/lib/libSystem.dylib | tail -n +3 | awk '{ print $1 }')
+
+
+    for i in $libs; do
+      if [ "$i" != "/usr/lib/system/libsystem_kernel.dylib" ] && [ "$i" != "/usr/lib/system/libsystem_c.dylib" ]; then
+        args="$args -reexport_library $i"
+      fi
+    done
+
+    ld -macosx_version_min 10.7 \
+       -arch x86_64 \
+       -dylib \
+       -o $out/lib/libSystem.B.dylib \
+       -compatibility_version 1.0 \
+       -current_version 1226.10.1 \
+       -reexport_library $out/lib/system/libsystem_c.dylib \
+       -reexport_library $out/lib/system/libsystem_kernel.dylib \
+       $args
+
+    ln -s libSystem.B.dylib $out/lib/libSystem.dylib
 
     # Set up links to pretend we work like a conventional unix (Apple's design, not mine!)
     for name in c dbm dl info m mx poll proc pthread rpcsvc util gcc_s.10.4 gcc_s.10.5; do
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
index 0c814899c3c4..ebeb5247b333 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
@@ -1,14 +1,3 @@
-_NSGetNextSearchPathEnumeration
-_NSStartSearchPathEnumeration
-_OSAtomicAdd32
-_OSAtomicAdd32Barrier
-_OSAtomicAnd32
-_OSAtomicDequeue
-_OSAtomicEnqueue
-_OSSpinLockLock
-_OSSpinLockUnlock
-__Block_copy
-__Block_release
 __CurrentRuneLocale
 __DefaultRuneLocale
 __Exit
@@ -62,20 +51,18 @@ ___bt_setcur
 ___bt_split
 ___bt_sync
 ___buf_free
-___bzero
 ___cVersionNumber
 ___cVersionString
 ___call_hash
-___chmod_extended
 ___cleanup
 ___cmp_D2A
 ___collate_equiv_match
 ___collate_load_error
 ___collate_lookup
-___commpage_gettimeofday
 ___copybits_D2A
 ___cxa_atexit
 ___cxa_finalize
+___cxa_finalize_ranges
 ___cxa_thread_atexit
 ___d2b_D2A
 ___dbpanic
@@ -85,34 +72,21 @@ ___default_utx
 ___delpair
 ___diff_D2A
 ___dtoa
-___error
-___exit
 ___expand_table
-___fchmod_extended
-___fcntl
-___fcntl_nocancel
 ___fflush
 ___fgetwc
 ___find_bigpair
 ___find_last_page
 ___fix_locale_grouping_str
-___fork
-___fpclassifyd
-___fpclassifyl
 ___fread
 ___free_ovflpage
 ___freedtoa
-___fstat64_extended
-___fstat_extended
 ___gdtoa
 ___gdtoa_locks
 ___get_buf
 ___get_page
-___getdirentries64
 ___gethex_D2A
-___getlogin
 ___getonlyClocaleconv
-___gettimeofday
 ___hash_open
 ___hdtoa
 ___hexdig_D2A
@@ -126,14 +100,11 @@ ___increment_D2A
 ___isctype
 ___istype
 ___istype_l
-___kill
 ___ldtoa
 ___libc_init
 ___lo0bits_D2A
 ___log2
 ___lshift_D2A
-___lstat64_extended
-___lstat_extended
 ___maskrune
 ___maskrune_l
 ___match_D2A
@@ -143,22 +114,15 @@ ___memccpy_chk
 ___memcpy_chk
 ___memmove_chk
 ___memset_chk
-___mkdir_extended
-___mkfifo_extended
 ___mult_D2A
 ___multadd_D2A
 ___nrv_alloc_D2A
-___open
-___open_extended
-___open_nocancel
 ___opendir2
 ___opendir2$INODE64
 ___ovfl_delete
 ___ovfl_get
 ___ovfl_put
 ___pow5mult_D2A
-___pthread_sigmask
-___pthread_workqueue_setkill
 ___put_page
 ___quorem_D2A
 ___ratio_D2A
@@ -179,29 +143,19 @@ ___rec_sync
 ___rec_vmap
 ___rec_vpipe
 ___reclaim_buf
-___recvfrom
-___recvfrom_nocancel
 ___rshift_D2A
 ___rv_alloc_D2A
 ___s2b_D2A
 ___sF
 ___sclose
 ___sdidinit
-___semwait_signal
-___semwait_signal_nocancel
-___sendto
-___sendto_nocancel
 ___set_ones_D2A
-___setlogin
 ___setonlyClocaleconv
-___settimeofday
 ___sflags
 ___sflush
 ___sfp
 ___sfvwrite
 ___sglue
-___sigaction
-___sigaltstack
 ___sinit
 ___slbexpand
 ___smakebuf
@@ -214,8 +168,6 @@ ___srget
 ___sseek
 ___stack_chk_fail
 ___stack_chk_guard
-___stat64_extended
-___stat_extended
 ___stderrp
 ___stdinp
 ___stdoutp
@@ -237,7 +189,6 @@ ___swbuf
 ___swhatbuf
 ___swrite
 ___swsetup
-___sysctl
 ___tens_D2A
 ___tinytens_D2A
 ___tolower
@@ -246,31 +197,25 @@ ___toupper
 ___toupper_l
 ___trailz_D2A
 ___ulp_D2A
-___umask_extended
 ___ungetc
 ___ungetwc
-___unix_conforming
 ___vsnprintf_chk
 ___vsprintf_chk
-___wait4
-___wait4_nocancel
 ___wcwidth
 ___wcwidth_l
 __allocenvstate
+__atexit_receipt
 __c_locale
 __cleanup
 __closeutx
 __copyenv
 __cthread_init_routine
 __deallocenvstate
-__dyld_register_func_for_add_image
 __endutxent
-__exit
 __flockfile_debug_stub
 __fseeko
 __ftello
 __fwalk
-__get_cpu_capabilities
 __getenvp
 __getutxent
 __getutxid
@@ -279,34 +224,20 @@ __inet_aton_check
 __init_clock_port
 __int_to_time
 __libc_fork_child
+__libc_initializer
 __long_to_time
 __mkpath_np
 __mktemp
 __openutx
-__os_alloc_once
-__os_alloc_once_table
 __os_assert_log
 __os_assert_log_ctx
 __os_assumes_log
 __os_assumes_log_ctx
 __os_avoid_tail_call
-__osx_assert_log
-__osx_assert_log_ctx
-__osx_assumes_log
-__osx_assumes_log_ctx
-__osx_avoid_tail_call
-__platform_bzero
-__platform_memccpy
-__platform_memchr
-__platform_memcmp
-__platform_memmove
-__platform_memset
-__platform_memset_pattern16
-__platform_memset_pattern4
-__platform_memset_pattern8
-__platform_strchr
-__platform_strcmp
-__platform_strncmp
+__os_crash
+__os_crash_callback
+__os_debug_log
+__os_debug_log_error_str
 __putenvp
 __pututxline
 __rand48_add
@@ -322,20 +253,7 @@ __setutxent
 __sigaction_nobind
 __sigintr
 __signal_nobind
-__sigtramp
 __sigvec_nobind
-__simple_asl_log
-__simple_asl_log_prog
-__simple_asl_msg_new
-__simple_asl_msg_set
-__simple_asl_send
-__simple_dprintf
-__simple_salloc
-__simple_sappend
-__simple_sfree
-__simple_sprintf
-__simple_string
-__simple_vsprintf
 __sread
 __sseek
 __swrite
@@ -345,14 +263,12 @@ __time_to_int
 __time_to_long
 __time_to_time32
 __time_to_time64
-__tlv_atexit
-__tlv_exit
 __unsetenvp
 __utmpxname
 _a64l
 _abort
+_abort_report_np
 _abs
-_access
 _acl_add_flag_np
 _acl_add_perm
 _acl_calc_mask
@@ -416,12 +332,6 @@ _arc4random_uniform
 _ascii2addr
 _asctime
 _asctime_r
-_asl_get
-_asl_new
-_asl_open
-_asl_send
-_asl_set
-_asl_set_query
 _asprintf
 _asprintf_l
 _asxprintf
@@ -442,8 +352,6 @@ _backtrace_symbols_fd
 _basename
 _bcmp
 _bcopy
-_bootstrap_parent
-_bootstrap_port
 _brk
 _bsd_signal
 _bsearch
@@ -451,7 +359,6 @@ _bsearch_b
 _btowc
 _btowc_l
 _bzero
-_calloc
 _catclose
 _catgets
 _catopen
@@ -471,17 +378,12 @@ _cgetnum
 _cgetset
 _cgetstr
 _cgetustr
-_chdir
-_chflags
-_chmod
 _chmodx_np
 _clearerr
 _clearerr_unlocked
 _clock
-_clock_get_time
 _clock_port
 _clock_sem
-_close$NOCANCEL
 _closedir
 _compat_mode
 _confstr
@@ -514,19 +416,13 @@ _digittoint
 _digittoint_l
 _dirfd
 _dirname
-_dispatch_get_global_queue
 _div
-_dladdr
-_dlsym
 _dprintf
 _dprintf_l
 _drand48
-_dup2
 _duplocale
 _dxprintf
 _dxprintf_exec
-_dyld_get_program_sdk_version
-_dyld_get_sdk_version
 _ecvt
 _encrypt
 _endttyent
@@ -545,26 +441,22 @@ _execle
 _execlp
 _execv
 _execvP
-_execve
 _execvp
 _exit
 _f_prealloc
-_fchdir
 _fchmodx_np
 _fclose
-_fcntl$NOCANCEL
 _fcvt
 _fdopen
 _fdopen$DARWIN_EXTSN
-_fegetenv
+_fdopendir
+_fdopendir$INODE64
 _feof
 _feof_unlocked
 _ferror
 _ferror_unlocked
-_fesetenv
 _fflagstostr
 _fflush
-_ffsctl
 _fgetc
 _fgetln
 _fgetpos
@@ -586,7 +478,6 @@ _filesec_query_property
 _filesec_set_property
 _filesec_unset_property
 _flockfile
-_flsl
 _fmtcheck
 _fmtmsg
 _fnmatch
@@ -606,33 +497,24 @@ _fputwc_l
 _fputws
 _fputws_l
 _fread
-_free
 _free_printf_comp
 _free_printf_domain
-_freeifaddrs
 _freelocale
 _freopen
 _fscanf
 _fscanf_l
-_fsctl
 _fseek
 _fseeko
 _fsetpos
-_fstat
-_fstat$INODE64
-_fstatfs
-_fstatfs$INODE64
 _fstatvfs
 _fstatx64_np
 _fstatx_np
 _fstatx_np$INODE64
-_fsync$NOCANCEL
 _fsync_volume_np
 _ftell
 _ftello
 _ftime
 _ftok
-_ftruncate
 _ftrylockfile
 _fts_children
 _fts_children$INODE64
@@ -660,7 +542,6 @@ _fwscanf_l
 _fxprintf
 _fxprintf_exec
 _gcvt
-_getattrlist
 _getbsize
 _getc
 _getc_unlocked
@@ -670,22 +551,11 @@ _getcwd
 _getdate
 _getdate_err
 _getdelim
-_getdirentries
 _getdiskbyname
-_getdtablesize
 _getenv
-_geteuid
-_getfsstat
-_getfsstat$INODE64
-_getfsstat64
-_getgrgid
-_getgrnam
-_getgroupcount
-_getgrouplist
 _getgroups$DARWIN_EXTSN
 _gethostid
 _gethostname
-_getifaddrs
 _getipv4sourcefilter
 _getlastlogx
 _getlastlogxbyname
@@ -703,24 +573,13 @@ _getopt_long_only
 _getpagesize
 _getpass
 _getpeereid
-_getpgrp
-_getpid
-_getpriority
 _getprogname
-_getpwnam
-_getpwuid
-_getpwuid_r
-_getrlimit
-_getrusage
 _gets
-_getsectiondata
-_getsockopt
 _getsourcefilter
 _getsubopt
 _gettimeofday
 _getttyent
 _getttynam
-_getuid
 _getusershell
 _getutmp
 _getutmpx
@@ -753,9 +612,7 @@ _hcreate
 _hdestroy
 _heapsort
 _heapsort_b
-_host_get_clock_service
 _hsearch
-_if_nametoindex
 _imaxabs
 _imaxdiv
 _index
@@ -777,7 +634,6 @@ _inet_ntop6
 _inet_pton
 _initstate
 _insque
-_ioctl
 _isalnum
 _isalnum_l
 _isalpha
@@ -808,7 +664,6 @@ _ispunct
 _ispunct_l
 _isrune
 _isrune_l
-_issetugid
 _isspace
 _isspace_l
 _isspecial
@@ -857,7 +712,7 @@ _iswxdigit_l
 _isxdigit
 _isxdigit_l
 _jrand48
-_kill
+_kOSThermalNotificationPressureLevelName
 _killpg
 _l64a
 _labs
@@ -882,26 +737,13 @@ _logout
 _logwtmp
 _lrand48
 _lsearch
-_lseek
-_lstat
-_lstat$INODE64
 _lstatx64_np
 _lstatx_np
 _lstatx_np$INODE64
 _lutimes
-_mach_absolute_time
-_mach_error_string
-_mach_host_self
-_mach_port_deallocate
-_mach_task_self_
-_mach_timebase_info
-_malloc
 _mblen
 _mblen_l
 _mbmb
-_mbr_gid_to_uuid
-_mbr_uid_to_uuid
-_mbr_uuid_to_id
 _mbrlen
 _mbrlen_l
 _mbrrune
@@ -931,7 +773,6 @@ _memset_pattern8
 _memset_s
 _mergesort
 _mergesort_b
-_mkdir
 _mkdirx_np
 _mkdtemp
 _mkfifox_np
@@ -940,7 +781,6 @@ _mkstemp
 _mkstemps
 _mktemp
 _mktime
-_mmap
 _monaddition
 _moncontrol
 _moncount
@@ -957,10 +797,6 @@ _mpool_open
 _mpool_put
 _mpool_sync
 _mrand48
-_munmap
-_nan
-_nanf
-_nanl
 _nanosleep
 _nanosleep$NOCANCEL
 _new_printf_comp
@@ -973,16 +809,10 @@ _nftw$INODE64
 _nice
 _nl_langinfo
 _nl_langinfo_l
-_notify_cancel
-_notify_check
-_notify_monitor_file
-_notify_post
-_notify_register_check
 _nrand48
 _off32
 _off64
 _offtime
-_open$NOCANCEL
 _opendev
 _opendir
 _opendir$INODE64
@@ -993,60 +823,21 @@ _opterr
 _optind
 _optopt
 _optreset
-_pathconf
 _pause
 _pause$NOCANCEL
 _pclose
 _perror
-_pipe
 _popen
 _popen$DARWIN_EXTSN
 _posix2time
 _posix_openpt
-_posix_spawn
-_posix_spawn_file_actions_addclose
-_posix_spawn_file_actions_adddup2
-_posix_spawn_file_actions_destroy
-_posix_spawn_file_actions_init
-_posix_spawnattr_destroy
-_posix_spawnattr_init
-_posix_spawnattr_setflags
-_posix_spawnattr_setsigdefault
-_posix_spawnattr_setsigmask
 _posix_spawnp
-_pread$NOCANCEL
 _printf
 _printf_l
-_proc_name
-_pselect
-_pselect$1050
-_pselect$DARWIN_EXTSN
-_pselect$DARWIN_EXTSN$NOCANCEL
-_pselect$NOCANCEL
 _psignal
 _psort
 _psort_b
 _psort_r
-_pthread_get_stackaddr_np
-_pthread_get_stacksize_np
-_pthread_getspecific
-_pthread_key_create
-_pthread_key_init_np
-_pthread_kill
-_pthread_mutex_destroy
-_pthread_mutex_init
-_pthread_mutex_lock
-_pthread_mutex_trylock
-_pthread_mutex_unlock
-_pthread_once
-_pthread_rwlock_destroy
-_pthread_rwlock_rdlock
-_pthread_rwlock_unlock
-_pthread_rwlock_wrlock
-_pthread_self
-_pthread_setspecific
-_pthread_sigmask
-_pthread_testcancel
 _ptsname
 _putc
 _putc_unlocked
@@ -1060,7 +851,6 @@ _putwc
 _putwc_l
 _putwchar
 _putwchar_l
-_pwrite$NOCANCEL
 _qsort
 _qsort_b
 _qsort_r
@@ -1078,14 +868,11 @@ _rb_tree_init
 _rb_tree_insert_node
 _rb_tree_iterate
 _rb_tree_remove_node
-_read$NOCANCEL
 _readdir
 _readdir$INODE64
 _readdir_r
 _readdir_r$INODE64
-_readlink
 _readpassphrase
-_realloc
 _reallocf
 _realpath
 _realpath$DARWIN_EXTSN
@@ -1113,7 +900,6 @@ _rewind
 _rewinddir
 _rewinddir$INODE64
 _rindex
-_rmdir
 _sbrk
 _scandir
 _scandir$INODE64
@@ -1124,15 +910,8 @@ _scanf_l
 _seed48
 _seekdir
 _seekdir$INODE64
-_select
-_select$1050
-_select$DARWIN_EXTSN
-_select$DARWIN_EXTSN$NOCANCEL
-_select$NOCANCEL
-_semaphore_create
 _send
 _send$NOCANCEL
-_setattrlist
 _setbuf
 _setbuffer
 _setenv
@@ -1140,24 +919,16 @@ _sethostid
 _sethostname
 _setinvalidrune
 _setipv4sourcefilter
-_setitimer
 _setkey
 _setlinebuf
 _setlocale
 _setlogin
 _setmode
-_setpgid
 _setpgrp
-_setpriority
 _setprogname
-_setregid
-_setreuid
 _setrgid
-_setrlimit
 _setruid
 _setrunelocale
-_setsid
-_setsockopt
 _setsourcefilter
 _setstate
 _settimeofday
@@ -1180,12 +951,9 @@ _sigismember
 _signal
 _sigpause
 _sigpause$NOCANCEL
-_sigprocmask
 _sigrelse
 _sigset
 _sigsetmask
-_sigsuspend
-_sigsuspend$NOCANCEL
 _sigvec
 _skip
 _sl_add
@@ -1197,10 +965,6 @@ _sleep$NOCANCEL
 _snprintf
 _snprintf_l
 _sockatmark
-_socket
-_socketpair
-_spin_lock
-_spin_unlock
 _sprintf
 _sprintf_l
 _sradixsort
@@ -1211,9 +975,6 @@ _srandom
 _srandomdev
 _sscanf
 _sscanf_l
-_stat
-_stat$INODE64
-_statfs$INODE64
 _statvfs
 _statx64_np
 _statx_np
@@ -1306,10 +1067,8 @@ _sysconf
 _sysctl
 _sysctlbyname
 _sysctlnametomib
-_syslog
 _system
 _system$NOCANCEL
-_task_set_special_port
 _tcdrain
 _tcdrain$NOCANCEL
 _tcflow
@@ -1346,6 +1105,23 @@ _towlower
 _towlower_l
 _towupper
 _towupper_l
+_tre_ast_new_catenation
+_tre_ast_new_iter
+_tre_ast_new_literal
+_tre_ast_new_node
+_tre_ast_new_union
+_tre_compile
+_tre_fill_pmatch
+_tre_free
+_tre_mem_alloc_impl
+_tre_mem_destroy
+_tre_mem_new_impl
+_tre_parse
+_tre_stack_destroy
+_tre_stack_new
+_tre_stack_num_objects
+_tre_tnfa_run_backtrack
+_tre_tnfa_run_parallel
 _tsearch
 _ttyname
 _ttyname_r
@@ -1356,13 +1132,11 @@ _tzset
 _tzsetwall
 _ualarm
 _ulimit
-_umask
 _umaskx_np
 _uname
 _ungetc
 _ungetwc
 _ungetwc_l
-_unlink
 _unlockpt
 _unsetenv
 _unvis
@@ -1370,7 +1144,6 @@ _uselocale
 _usleep
 _usleep$NOCANCEL
 _utime
-_utimes
 _utmpxname
 _uuid_clear
 _uuid_compare
@@ -1407,7 +1180,6 @@ _vfwscanf_l
 _vfxprintf
 _vfxprintf_exec
 _vis
-_vm_allocate
 _vprintf
 _vprintf_l
 _vscanf
@@ -1436,7 +1208,6 @@ _vxprintf_exec
 _wait
 _wait$NOCANCEL
 _wait3
-_wait4
 _waitpid
 _waitpid$NOCANCEL
 _warn
@@ -1519,12 +1290,9 @@ _wordexp
 _wordfree
 _wprintf
 _wprintf_l
-_write$NOCANCEL
-_writev$NOCANCEL
 _wscanf
 _wscanf_l
 _wtmpxname
 _xprintf
 _xprintf_exec
-dyld_stub_binder
 mcount
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
index 9d53dea70253..c92aed31c5e7 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
@@ -9,17 +9,20 @@ ___access_extended
 ___aio_suspend_nocancel
 ___bind
 ___bsdthread_create
+___bsdthread_ctl
 ___bsdthread_register
 ___bsdthread_terminate
 ___carbon_delete
 ___chmod
 ___chmod_extended
-___chud
 ___close_nocancel
+___coalition
+___coalition_info
 ___commpage_gettimeofday
 ___connect
 ___connect_nocancel
 ___copyfile
+___csrctl
 ___delete
 ___disable_threadsignal
 ___error
@@ -29,7 +32,6 @@ ___fchmod_extended
 ___fcntl
 ___fcntl_nocancel
 ___fork
-___fsgetpath
 ___fstat64_extended
 ___fstat_extended
 ___fsync_nocancel
@@ -37,7 +39,6 @@ ___get_remove_counter
 ___getattrlist
 ___getdirentries64
 ___gethostuuid
-___getlcid
 ___getlogin
 ___getpeername
 ___getpid
@@ -47,6 +48,7 @@ ___getsockname
 ___gettid
 ___gettimeofday
 ___getwgroups
+___guarded_open_dprotected_np
 ___guarded_open_np
 ___identitysvc
 ___inc_remove_counter
@@ -54,11 +56,14 @@ ___initgroups
 ___ioctl
 ___iopolicysys
 ___kdebug_trace
+___kdebug_trace64
+___kdebug_trace_string
 ___kernelVersionNumber
 ___kernelVersionString
 ___kill
 ___lchown
 ___libkernel_init
+___libkernel_voucher_init
 ___listen
 ___lseek
 ___lstat64_extended
@@ -66,8 +71,6 @@ ___lstat_extended
 ___mac_execve
 ___mac_get_fd
 ___mac_get_file
-___mac_get_lcid
-___mac_get_lctx
 ___mac_get_link
 ___mac_get_mount
 ___mac_get_pid
@@ -76,10 +79,10 @@ ___mac_getfsstat
 ___mac_mount
 ___mac_set_fd
 ___mac_set_file
-___mac_set_lctx
 ___mac_set_link
 ___mac_set_proc
 ___mac_syscall
+___microstackshot
 ___mkdir_extended
 ___mkfifo_extended
 ___mmap
@@ -96,12 +99,16 @@ ___open
 ___open_dprotected_np
 ___open_extended
 ___open_nocancel
+___openat
+___openat_nocancel
 ___pipe
 ___poll_nocancel
 ___posix_spawn
 ___pread_nocancel
 ___proc_info
 ___process_policy
+___pselect
+___pselect_nocancel
 ___psynch_cvbroad
 ___psynch_cvclrprepost
 ___psynch_cvsignal
@@ -131,6 +138,7 @@ ___recvfrom_nocancel
 ___recvmsg
 ___recvmsg_nocancel
 ___rename
+___renameat
 ___rmdir
 ___sandbox_me
 ___sandbox_mm
@@ -149,8 +157,8 @@ ___sendmsg_nocancel
 ___sendto
 ___sendto_nocancel
 ___setattrlist
-___setlcid
 ___setlogin
+___setpriority
 ___setregid
 ___setreuid
 ___setrlimit
@@ -159,6 +167,8 @@ ___settid
 ___settid_with_pid
 ___settimeofday
 ___setwgroups
+___sfi_ctl
+___sfi_pidctl
 ___shared_region_check_np
 ___shared_region_map_and_slide_np
 ___shm_open
@@ -171,20 +181,24 @@ ___sigsuspend
 ___sigsuspend_nocancel
 ___sigwait
 ___socketpair
-___stack_snapshot
+___stack_snapshot_with_config
 ___stat64_extended
 ___stat_extended
 ___syscall
 ___syscall_logger
 ___sysctl
+___sysctlbyname
 ___telemetry
 ___thread_selfid
+___thread_selfusage
 ___umask_extended
 ___unlink
+___unlinkat
 ___vfork
 ___wait4
 ___wait4_nocancel
 ___waitid_nocancel
+___work_interval_ctl
 ___workq_kernreturn
 ___workq_open
 ___write_nocancel
@@ -238,6 +252,7 @@ __kernelrpc_mach_port_set_attributes
 __kernelrpc_mach_port_set_context
 __kernelrpc_mach_port_set_mscount
 __kernelrpc_mach_port_set_seqno
+__kernelrpc_mach_port_space_basic_info
 __kernelrpc_mach_port_space_info
 __kernelrpc_mach_port_type
 __kernelrpc_mach_port_unguard
@@ -253,6 +268,9 @@ __kernelrpc_mach_vm_protect_trap
 __kernelrpc_mach_vm_read
 __kernelrpc_mach_vm_remap
 __kernelrpc_task_set_port_space
+__kernelrpc_thread_policy
+__kernelrpc_thread_policy_set
+__kernelrpc_thread_set_policy
 __kernelrpc_vm_map
 __kernelrpc_vm_read
 __kernelrpc_vm_remap
@@ -304,11 +322,18 @@ _clock_sleep
 _clock_sleep_trap
 _close
 _close$NOCANCEL
+_coalition_create
+_coalition_info_resource_usage
+_coalition_reap
+_coalition_terminate
 _connect
 _connect$NOCANCEL
 _connectx
 _csops
 _csops_audittoken
+_csr_check
+_csr_get_active_config
+_denap_boost_assertion_token
 _disconnectx
 _dup
 _dup2
@@ -321,10 +346,13 @@ _exception_raise_state
 _exception_raise_state_identity
 _exchangedata
 _execve
+_faccessat
 _fchdir
 _fchflags
 _fchmod
+_fchmodat
 _fchown
+_fchownat
 _fcntl
 _fcntl$NOCANCEL
 _fdatasync
@@ -344,6 +372,9 @@ _fsetxattr
 _fstat
 _fstat$INODE64
 _fstat64
+_fstatat
+_fstatat$INODE64
+_fstatat64
 _fstatfs
 _fstatfs$INODE64
 _fstatfs64
@@ -353,6 +384,8 @@ _ftruncate
 _futimes
 _get_dp_control_port
 _getattrlist
+_getattrlistat
+_getattrlistbulk
 _getaudit
 _getaudit_addr
 _getauid
@@ -385,11 +418,18 @@ _getsockopt
 _getuid
 _getwgroups_np
 _getxattr
+_grab_pgo_data
 _guarded_close_np
 _guarded_kqueue_np
+_guarded_open_dprotected_np
 _guarded_open_np
+_guarded_pwrite_np
+_guarded_write_np
+_guarded_writev_np
+_host_create_mach_voucher
 _host_default_memory_manager
 _host_get_UNDServer
+_host_get_atm_diagnostic_flag
 _host_get_boot_info
 _host_get_clock_control
 _host_get_clock_service
@@ -406,12 +446,15 @@ _host_processor_set_priv
 _host_processor_sets
 _host_processors
 _host_reboot
+_host_register_mach_voucher_attr_manager
+_host_register_well_known_mach_voucher_attr_manager
 _host_request_notification
 _host_security_create_task_token
 _host_security_set_task_token
 _host_self
 _host_self_trap
 _host_set_UNDServer
+_host_set_atm_diagnostic_flag
 _host_set_exception_ports
 _host_set_special_port
 _host_statistics
@@ -426,8 +469,11 @@ _internal_catch_exc_subsystem
 _ioctl
 _issetugid
 _kas_info
+_kdebug_trace
+_kdebug_trace_string
 _kevent
 _kevent64
+_kevent_qos
 _kext_request
 _kill
 _kmod_control
@@ -438,6 +484,7 @@ _kqueue
 _lchown
 _ledger
 _link
+_linkat
 _lio_listio
 _listen
 _listxattr
@@ -454,6 +501,7 @@ _lstat
 _lstat$INODE64
 _lstat64
 _mach_absolute_time
+_mach_approximate_time
 _mach_error
 _mach_error_full_diag
 _mach_error_string
@@ -462,6 +510,7 @@ _mach_host_self
 _mach_init
 _mach_make_memory_entry
 _mach_make_memory_entry_64
+_mach_memory_info
 _mach_memory_object_memory_entry
 _mach_memory_object_memory_entry_64
 _mach_msg
@@ -510,6 +559,7 @@ _mach_port_set_attributes
 _mach_port_set_context
 _mach_port_set_mscount
 _mach_port_set_seqno
+_mach_port_space_basic_info
 _mach_port_space_info
 _mach_port_type
 _mach_port_unguard
@@ -540,6 +590,12 @@ _mach_vm_region_recurse
 _mach_vm_remap
 _mach_vm_wire
 _mach_vm_write
+_mach_voucher_attr_command
+_mach_voucher_deallocate
+_mach_voucher_debug_info
+_mach_voucher_extract_all_attr_recipes
+_mach_voucher_extract_attr_content
+_mach_voucher_extract_attr_recipe
 _mach_wait_until
 _mach_zone_force_gc
 _mach_zone_info
@@ -565,6 +621,7 @@ _mk_timer_cancel
 _mk_timer_create
 _mk_timer_destroy
 _mkdir
+_mkdirat
 _mkfifo
 _mknod
 _mlock
@@ -573,6 +630,7 @@ _mmap
 _modwatch
 _mount
 _mprotect
+_mremap_encrypted
 _msg_receive
 _msg_rpc
 _msg_send
@@ -588,6 +646,8 @@ _msync$NOCANCEL
 _munlock
 _munlockall
 _munmap
+_necp_match_policy
+_netagent_trigger
 _netname_check_in
 _netname_check_out
 _netname_look_up
@@ -599,12 +659,17 @@ _normal_boost_assertion_token
 _open
 _open$NOCANCEL
 _open_dprotected_np
+_openat
+_openat$NOCANCEL
+_openbyid_np
 _panic
 _panic_init
 _pathconf
 _peeloff
 _pid_for_task
+_pid_hibernate
 _pid_resume
+_pid_shutdown_sockets
 _pid_suspend
 _pipe
 _poll
@@ -621,6 +686,8 @@ _posix_spawn_file_actions_addopen
 _posix_spawn_file_actions_destroy
 _posix_spawn_file_actions_init
 _posix_spawnattr_destroy
+_posix_spawnattr_get_darwin_role_np
+_posix_spawnattr_get_qos_clamp_np
 _posix_spawnattr_getbinpref_np
 _posix_spawnattr_getcpumonitor
 _posix_spawnattr_getflags
@@ -631,9 +698,12 @@ _posix_spawnattr_getprocesstype_np
 _posix_spawnattr_getsigdefault
 _posix_spawnattr_getsigmask
 _posix_spawnattr_init
+_posix_spawnattr_set_darwin_role_np
 _posix_spawnattr_set_importancewatch_port_np
+_posix_spawnattr_set_qos_clamp_np
 _posix_spawnattr_setauditsessionport_np
 _posix_spawnattr_setbinpref_np
+_posix_spawnattr_setcoalition_np
 _posix_spawnattr_setcpumonitor
 _posix_spawnattr_setcpumonitor_default
 _posix_spawnattr_setexceptionports_np
@@ -648,7 +718,10 @@ _posix_spawnattr_setspecialport_np
 _pread
 _pread$NOCANCEL
 _proc_clear_delayidlesleep
+_proc_clear_dirty
 _proc_clear_vmpressure
+_proc_denap_assertion_begin_with_msg
+_proc_denap_assertion_complete
 _proc_disable_apptype
 _proc_disable_cpumon
 _proc_disable_wakemon
@@ -661,8 +734,10 @@ _proc_importance_assertion_begin_with_msg
 _proc_importance_assertion_complete
 _proc_kmsgbuf
 _proc_libversion
+_proc_list_uptrs
 _proc_listallpids
 _proc_listchildpids
+_proc_listcoalitions
 _proc_listpgrppids
 _proc_listpids
 _proc_listpidspath
@@ -671,19 +746,23 @@ _proc_pid_rusage
 _proc_pidfdinfo
 _proc_pidfileportinfo
 _proc_pidinfo
+_proc_pidoriginatorinfo
 _proc_pidpath
 _proc_regionfilename
 _proc_rlimit_control
 _proc_set_cpumon_defaults
 _proc_set_cpumon_params
+_proc_set_cpumon_params_fatal
 _proc_set_delayidlesleep
 _proc_set_dirty
 _proc_set_owner_vmpressure
 _proc_set_wakemon_defaults
 _proc_set_wakemon_params
 _proc_setpcontrol
+_proc_setthread_cpupercent
 _proc_suppress
 _proc_terminate
+_proc_trace_log
 _proc_track_dirty
 _proc_uuid_policy
 _processor_assign
@@ -704,6 +783,11 @@ _processor_set_statistics
 _processor_set_tasks
 _processor_set_threads
 _processor_start
+_pselect
+_pselect$1050
+_pselect$DARWIN_EXTSN
+_pselect$DARWIN_EXTSN$NOCANCEL
+_pselect$NOCANCEL
 _pthread_getugid_np
 _pthread_setugid_np
 _ptrace
@@ -714,6 +798,7 @@ _quotactl
 _read
 _read$NOCANCEL
 _readlink
+_readlinkat
 _readv
 _readv$NOCANCEL
 _reboot
@@ -721,8 +806,11 @@ _recvfrom
 _recvfrom$NOCANCEL
 _recvmsg
 _recvmsg$NOCANCEL
+_recvmsg_x
 _removexattr
 _rename
+_rename_ext
+_renameat
 _revoke
 _rmdir
 _searchfs
@@ -764,6 +852,7 @@ _semsys
 _sendfile
 _sendmsg
 _sendmsg$NOCANCEL
+_sendmsg_x
 _sendto
 _sendto$NOCANCEL
 _set_dp_control_port
@@ -790,6 +879,10 @@ _setsockopt
 _setuid
 _setwgroups_np
 _setxattr
+_sfi_get_class_offtime
+_sfi_process_get_flags
+_sfi_process_set_flags
+_sfi_set_class_offtime
 _shm_open
 _shm_unlink
 _shmat
@@ -805,6 +898,15 @@ _sigsuspend$NOCANCEL
 _socket
 _socket_delegate
 _socketpair
+_stackshot_capture_with_config
+_stackshot_config_create
+_stackshot_config_dealloc
+_stackshot_config_dealloc_buffer
+_stackshot_config_get_stackshot_buffer
+_stackshot_config_get_stackshot_size
+_stackshot_config_set_flags
+_stackshot_config_set_pid
+_stackshot_config_set_size_hint
 _stat
 _stat$INODE64
 _stat64
@@ -815,10 +917,13 @@ _swapon
 _swtch
 _swtch_pri
 _symlink
+_symlinkat
 _sync
 _syscall
 _syscall_thread_switch
+_system_get_sfi_window
 _system_override
+_system_set_sfi_window
 _task_assign
 _task_assign_default
 _task_create
@@ -826,6 +931,7 @@ _task_for_pid
 _task_get_assignment
 _task_get_emulation_vector
 _task_get_exception_ports
+_task_get_mach_voucher
 _task_get_special_port
 _task_get_state
 _task_info
@@ -843,6 +949,7 @@ _task_set_emulation
 _task_set_emulation_vector
 _task_set_exception_ports
 _task_set_info
+_task_set_mach_voucher
 _task_set_phys_footprint_limit
 _task_set_policy
 _task_set_port_space
@@ -852,6 +959,7 @@ _task_set_state
 _task_suspend
 _task_suspend2
 _task_swap_exception_ports
+_task_swap_mach_voucher
 _task_terminate
 _task_threads
 _task_zone_info
@@ -864,6 +972,8 @@ _thread_create_running
 _thread_depress_abort
 _thread_get_assignment
 _thread_get_exception_ports
+_thread_get_mach_voucher
+_thread_get_register_pointer_values
 _thread_get_special_port
 _thread_get_state
 _thread_info
@@ -874,11 +984,13 @@ _thread_resume
 _thread_sample
 _thread_self_trap
 _thread_set_exception_ports
+_thread_set_mach_voucher
 _thread_set_policy
 _thread_set_special_port
 _thread_set_state
 _thread_suspend
 _thread_swap_exception_ports
+_thread_swap_mach_voucher
 _thread_switch
 _thread_terminate
 _thread_wire
@@ -886,6 +998,7 @@ _truncate
 _umask
 _undelete
 _unlink
+_unlinkat
 _unmount
 _utimes
 _vfork
@@ -917,12 +1030,20 @@ _vm_region_recurse_64
 _vm_remap
 _vm_wire
 _vm_write
+_voucher_mach_msg_adopt
+_voucher_mach_msg_clear
+_voucher_mach_msg_revert
+_voucher_mach_msg_set
 _vprintf_stderr_func
 _wait4
 _waitevent
 _waitid
 _waitid$NOCANCEL
 _watchevent
+_work_interval_create
+_work_interval_destroy
+_work_interval_notify
+_work_interval_notify_simple
 _write
 _write$NOCANCEL
 _writev
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index b530b7578e8e..fc81d3fec8d1 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -6,14 +6,14 @@
 # Allow passing in bootstrap files directly so we can test the stdenv bootstrap process when changing the bootstrap tools
 , bootstrapFiles ? let
   fetch = { file, sha256, executable ? true }: import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-darwin/x86_64/62540508837664e9b366e36d1265502db4329a6e/${file}";
+    url = "http://tarballs.nixos.org/stdenv-darwin/x86_64/33f59c9d11b8d5014dfd18cc11a425f6393c884a/${file}";
     inherit sha256 system executable;
   }; in {
-    sh      = fetch { file = "sh";    sha256 = "1qpg16qbqqkmcr5an4d73p6q55izhlzmdd3nvid8gp7f3f9spbz7"; };
-    bzip2   = fetch { file = "bzip2"; sha256 = "1g67sh51fa2ws9wch5gznvrmmh27mks3dbnp6gvac43qxdnv6mpz"; };
-    mkdir   = fetch { file = "mkdir"; sha256 = "1lkp6y33lsrj9yif1cfrw5g021pffynrdscrz3ds19hslg55w4dw"; };
-    cpio    = fetch { file = "cpio";  sha256 = "115pgrl0pcq2h4yfqrmfvffl0dcabw4mgkc91aphd913wrzfmlz9"; };
-    tarball = fetch { file = "bootstrap-tools.cpio.bz2"; sha256 = "1ak16xrj41l15ads5l2kfgbyrb1lczzhmi8nln5h0np8r3w9frw9"; executable = false; };
+    sh      = fetch { file = "sh";    sha256 = "1rx4kg6358xdj05z0m139a0zn4f4zfmq4n4vimlmnwyfiyn4x7wk"; };
+    bzip2   = fetch { file = "bzip2"; sha256 = "104qnhzk79vkbp2yi0kci6lszgfppvrwk3rgxhry842ly1xz2r7l"; };
+    mkdir   = fetch { file = "mkdir"; sha256 = "0d91c19xjzmqisncvldv79d7ddzai9l7vcmajhwlwwv74g6da5yl"; };
+    cpio    = fetch { file = "cpio";  sha256 = "0lw057bmcqls96j0gv1n3mgl66q31mba7i413cbkkaf0rfzz3dxj"; };
+    tarball = fetch { file = "bootstrap-tools.cpio.bz2"; sha256 = "13ihbj002pis3fgy1d9c4fi7flca21z9brjsjkklm82h5b4nlwxl"; executable = false; };
   }
 }:
 
diff --git a/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh b/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
index 8033c7004d93..66c4e9ebeda9 100644
--- a/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
+++ b/pkgs/stdenv/darwin/unpack-bootstrap-tools.sh
@@ -17,9 +17,44 @@ for i in $out/bin/*; do
   fi
 done
 
+install_name_tool \
+  -id $out/lib/system/libsystem_c.dylib \
+  $out/lib/system/libsystem_c.dylib
+
+install_name_tool \
+  -id $out/lib/system/libsystem_kernel.dylib \
+  $out/lib/system/libsystem_kernel.dylib
+
+# TODO: this logic basically duplicates similar logic in the Libsystem expression. Deduplicate them!
+libs=$(otool -arch x86_64 -L /usr/lib/libSystem.dylib | tail -n +3 | awk '{ print $1 }')
+
+for i in $libs; do
+  if [ "$i" != "/usr/lib/system/libsystem_kernel.dylib" ] && [ "$i" != "/usr/lib/system/libsystem_c.dylib" ]; then
+    args="$args -reexport_library $i"
+  fi
+done
+
+ld -macosx_version_min 10.7 \
+   -arch x86_64 \
+   -dylib \
+   -o $out/lib/libSystem.B.dylib \
+   -compatibility_version 1.0 \
+   -current_version 1226.10.1 \
+   -reexport_library $out/lib/system/libsystem_c.dylib \
+   -reexport_library $out/lib/system/libsystem_kernel.dylib \
+   $args
+
+ln -s libSystem.B.dylib $out/lib/libSystem.dylib
+
+for name in c dbm dl info m mx poll proc pthread rpcsvc util gcc_s.10.4 gcc_s.10.5; do
+  ln -s libSystem.dylib $out/lib/lib$name.dylib
+done
+
+ln -s libresolv.9.dylib $out/lib/libresolv.dylib
+
 for i in $out/lib/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
-  if ! test -L $i; then
-    echo patching $i
+  if test ! -L "$i" -a "$i" != "$out/lib/libSystem*.dylib"; then
+    echo "Patching $i"
 
     id=$(otool -D "$i" | tail -n 1)
     install_name_tool -id "$(dirname $i)/$(basename $id)" $i