so it may be that the new checks are at the OS syscall level, but are there (ironically) to ENABLE ObjC calls between fork() and exec()