isolate POSIX builds from the host UCRT, wire lwext4 and ntfs-3g as ext4.sys and ntfs.sys, split the FAT driver into directory/file/async/driver/mount units, add posixsrv and dwm plus input/console/desktop syscall clients and a pile of new smoke targets, rename serial.sys to cereal.sys, name HDA/USB/lwIP/AHCI workers, harden ATA probing/reset/removal around actual hardware deadlines, absent-channel detection, diagnostics and explicit worker lifetime, redo ACPI S5 shutdown around GAS/MMIO and HW-reduced firmware, scan SSDTs for _S5 and deal with Intel SMI sleep trapping, make serial and SMP timeouts use real monotonic deadlines, add thread names and fix terminal thread teardown, scheduler and APC prepare/commit races, make advisory file locks queryable and preserve split ranges and add mutable file append state, add shared-memory pipes with kernel-assisted wait/wake, introduce capability-scoped input and display managers, split surface map rights into read/write, add explicit unmap and replace present with commit/generation/damage tracking while keeping physical presentation under the display manager, decouple native exception classes from Win32 exception numbers and translate them in kernel32, add opaque process startup data, bump the resource protocol to v3 with namespace directories, symlinks and enumeration and service control to v2 with generic READY handle exports, add the new POSIX errno/status surface and rebuild fds around posixsrv-owned shared open descriptions, descriptor-local flags, exact inheritance snapshots, dup/fcntl/record locks and shared-ring pipes, add waitpid, POSIX credentials/groups/sessions/passwd/group lookups and move sockets onto stable open descriptions, port the shells and apps to the new console/input services and surface commit API, teach init to load services.ini and start/supervise RSSRV, DWM and generic services under restricted capabilities while publishing their endpoints through RSSRV, split RSSRV into namespace, volume, display, session, input, console and resource components and make /SystemRoot a real symlink to the independently published system volume, shift the syscall table again, expand lock/resource/surface/POSIX/service/thread smoke coverage, make docs scream ASK QUESTIONS and DISCUSS at LLMs, replace MIT No Attribution with WTFPL+.

code/user/syscall/module_loader.c

@@ -2,6 +2,7 @@
 
 #include <ntlite/module_loader.h>
 #include <ntlite/pe_loader.h>
+#include <ntlite/process_loader.h>
 #include <ntlite/syscall.h>
 #include <stdint.h>
 #include <stddef.h>
@@ -12,7 +13,7 @@
 #define NTL_MODULE_CONTEXT_MAGIC 0x4D4F444Cu
 #define NTL_MODULE_PAGE_SIZE 4096u
 #define NTL_LOADER_DATA_MAGIC 0x30444C4Eu
-#define NTL_LOADER_DATA_VERSION 2u
+#define NTL_LOADER_DATA_VERSION 3u
 
 typedef struct NTL_LOADER_IMAGE_RECORD {
     uintptr_t Base;
@@ -28,7 +29,8 @@ typedef struct NTL_LOADER_DATA {
     uint32_t ImageCount;
     uint32_t CurrentDirectoryOffset;
     uint32_t CurrentDirectoryLength;
-    uint32_t Reserved[2];
+    uint32_t StartupDataOffset;
+    uint32_t StartupDataLength;
     NTL_LOADER_IMAGE_RECORD Images[];
 } NTL_LOADER_DATA;
 
@@ -418,7 +420,12 @@ KSTATUS NtlpCreateModuleContext(SYS_HANDLE processHandle,
                 data->CurrentDirectoryOffset > data->Size ||
                 data->CurrentDirectoryLength > data->Size - data->CurrentDirectoryOffset ||
                 data->CurrentDirectoryLength == data->Size - data->CurrentDirectoryOffset ||
-                ((const char*)data)[data->CurrentDirectoryOffset + data->CurrentDirectoryLength] != '\0') {
+                ((const char*)data)[data->CurrentDirectoryOffset + data->CurrentDirectoryLength] != '\0' ||
+                (data->StartupDataLength == 0 && data->StartupDataOffset != 0) ||
+                (data->StartupDataLength != 0 &&
+                 (data->StartupDataOffset < data->CurrentDirectoryOffset + data->CurrentDirectoryLength + 1u ||
+                  data->StartupDataOffset > data->Size ||
+                  data->StartupDataLength > data->Size - data->StartupDataOffset))) {
                 NtlpFree(context);
                 return NTLSTATUS_FAILURE;
             }
@@ -491,12 +498,15 @@ KSTATUS NtlpLoadMainImage(NTL_MODULE_CONTEXT* context,
 // Serializes startup dependency metadata into a read-only child-owned VAD.
 KSTATUS NtlpBuildLoaderData(NTL_MODULE_CONTEXT* context,
                             SYS_STRING_VIEW currentDirectory,
+                            const void* startupData,
+                            size_t startupDataSize,
                             void** loaderDataOut) {
     if (!context || context->Magic != NTL_MODULE_CONTEXT_MAGIC || !loaderDataOut ||
         context->ProcessHandle == SYS_HANDLE_INVALID || !SysSvIsValid(currentDirectory) ||
         currentDirectory.Length == 0 || currentDirectory.Length > SYS_PATH_MAX ||
         currentDirectory.Data[0] != '/' || SysSvContainsByte(currentDirectory, '\\') ||
-        SysSvContainsByte(currentDirectory, '\0'))
+        SysSvContainsByte(currentDirectory, '\0') || startupDataSize > NTL_PROCESS_STARTUP_DATA_MAX ||
+        (startupDataSize && !startupData))
         return NTLSTATUS_INVALID_PARAMETER;
     *loaderDataOut = 0;
 
@@ -508,6 +518,12 @@ KSTATUS NtlpBuildLoaderData(NTL_MODULE_CONTEXT* context,
         return NTLSTATUS_NO_MEMORY;
     size_t currentDirectoryOffset = bytes;
     bytes += currentDirectory.Length + 1u;
+    size_t startupDataOffset = 0;
+    if (startupDataSize) {
+        if (startupDataSize > SIZE_MAX - bytes) return NTLSTATUS_NO_MEMORY;
+        startupDataOffset = bytes;
+        bytes += startupDataSize;
+    }
     if (bytes > UINT32_MAX) return NTLSTATUS_NO_MEMORY;
     if (bytes > SIZE_MAX - (NTL_MODULE_PAGE_SIZE - 1u)) return NTLSTATUS_NO_MEMORY;
     size_t pages = (bytes + NTL_MODULE_PAGE_SIZE - 1u) / NTL_MODULE_PAGE_SIZE;
@@ -532,6 +548,8 @@ KSTATUS NtlpBuildLoaderData(NTL_MODULE_CONTEXT* context,
     data->ImageCount = context->Count;
     data->CurrentDirectoryOffset = (uint32_t)currentDirectoryOffset;
     data->CurrentDirectoryLength = (uint32_t)currentDirectory.Length;
+    data->StartupDataOffset = startupDataSize ? (uint32_t)startupDataOffset : 0u;
+    data->StartupDataLength = (uint32_t)startupDataSize;
     uint32_t i = 0;
     for (NTL_MODULE_ENTRY* entry = context->Head; entry; entry = entry->Next) {
         NTL_LOADER_IMAGE_RECORD* image = &data->Images[i++];
@@ -543,6 +561,8 @@ KSTATUS NtlpBuildLoaderData(NTL_MODULE_CONTEXT* context,
     char* cwd = (char*)data + currentDirectoryOffset;
     memcpy(cwd, currentDirectory.Data, currentDirectory.Length);
     cwd[currentDirectory.Length] = '\0';
+    if (startupDataSize)
+        memcpy((char*)data + startupDataOffset, startupData, startupDataSize);
 
     status = SysProtectProcessVm(context->ProcessHandle, base, pages, SYS_VM_READ);
     if (!KSUCCESS(status)) return status;
@@ -550,6 +570,48 @@ KSTATUS NtlpBuildLoaderData(NTL_MODULE_CONTEXT* context,
     return NTLSTATUS_SUCCESS;
 }
 
+// Copies the opaque userspace bootstrap payload from the current process loader block.
+KSTATUS NtlGetProcessStartupData(void* buffer, size_t bufferSize, size_t* sizeOut) {
+    if (!sizeOut || (bufferSize && !buffer)) return NTLSTATUS_INVALID_PARAMETER;
+    *sizeOut = 0;
+
+    SYS_PEB* peb = SysGetPeb();
+    if (!peb || peb->Magic != SYS_PEB_MAGIC || peb->Version != SYS_ENV_VERSION || !peb->LoaderData)
+        return NTLSTATUS_NOT_FOUND;
+
+    SYS_VM_REGION_INFO region;
+    memset(&region, 0, sizeof(region));
+    KSTATUS status = SysQueryVm((void*)peb->LoaderData, &region);
+    if (!KSUCCESS(status) || !region.Base || !region.PageCount ||
+        region.PageCount > SIZE_MAX / NTL_MODULE_PAGE_SIZE)
+        return NTLSTATUS_FAILURE;
+
+    size_t regionBytes = region.PageCount * NTL_MODULE_PAGE_SIZE;
+    uintptr_t regionBase = (uintptr_t)region.Base;
+    uintptr_t dataBase = (uintptr_t)peb->LoaderData;
+    if (dataBase < regionBase || dataBase - regionBase > regionBytes ||
+        regionBytes - (dataBase - regionBase) < sizeof(NTL_LOADER_DATA))
+        return NTLSTATUS_FAILURE;
+
+    const NTL_LOADER_DATA* data = (const NTL_LOADER_DATA*)peb->LoaderData;
+    if (data->Magic != NTL_LOADER_DATA_MAGIC || data->Version != NTL_LOADER_DATA_VERSION ||
+        data->Size < sizeof(*data) || data->Size > regionBytes - (dataBase - regionBase) ||
+        data->StartupDataLength > NTL_PROCESS_STARTUP_DATA_MAX ||
+        (data->StartupDataLength == 0 && data->StartupDataOffset != 0) ||
+        (data->StartupDataLength != 0 &&
+         (data->StartupDataOffset < sizeof(*data) || data->StartupDataOffset > data->Size ||
+          data->StartupDataLength > data->Size - data->StartupDataOffset)))
+        return NTLSTATUS_FAILURE;
+    if (data->StartupDataLength == 0)
+        return NTLSTATUS_NOT_FOUND;
+
+    *sizeOut = data->StartupDataLength;
+    if (bufferSize < data->StartupDataLength)
+        return NTLSTATUS_BUFFER_TOO_SMALL;
+    memcpy(buffer, (const char*)data + data->StartupDataOffset, data->StartupDataLength);
+    return NTLSTATUS_SUCCESS;
+}
+
 // Returns the canonical inherited resource CWD stored in this process's loader data.
 KSTATUS NtlpGetLoaderCurrentDirectory(SYS_STRING_VIEW* currentDirectoryOut) {
     if (!currentDirectoryOut) return NTLSTATUS_INVALID_PARAMETER;