kernel32 kept its own GetTickCount and GetTickCount64, which read KUSER_SHARED_DATA at 0x7ffe0000. iOS cannot map that page, so every call trapped and was serviced by the sub-floor fault path: a program that polls kernel32!GetTickCount spent most of its fault samples there (thousands of Mach exceptions a second).
kernelbase's versions (ml1232) read the same clock with one NtQueryPerformanceCounter call, so kernel32 now forwards to them: -import in kernel32.spec, the two bodies and the unused user_shared_data pointer removed from sync.c. The rebuilt arm64ec kernel32.dll imports both from kernelbase; its export list is unchanged.
Madeira side: only app/Madeira/arm64ec-windows/kernel32.dll needs a rebuild from this commit. The fork's test builds have carried it since 2026-10-15; tests/host/check-aux-iat-heal.py needs new fixture offsets for the rebuilt DLL (the fork has them).
🤖 Generated with Claude Code