@@ -443,7 +443,10 @@
                     <configureArg>--libdir=${project.build.directory}/native-build/target/lib</configureArg>
                     <configureArg>CFLAGS=-O3 -Werror -fno-omit-frame-pointer -fvisibility=hidden -Wunused -Wno-unused-value</configureArg>
                     <configureArg>CPPFLAGS=-DHAVE_OPENSSL -I${boringsslCheckoutDir}/include</configureArg>
-                    <configureArg>LDFLAGS=-L${boringsslBuildDir} -lssl -lcrypto -ldecrepit -l:libstdc++.a -l:libgcc.a -l:libgcc_eh.a</configureArg>
+                    <!-- gc-sections: this BoringSSL drags in libstdc++'s std::random_device, which nothing
+                         calls and which imports arc4random (glibc 2.36+, absent from musl). Dropping
+                         the dead code removes the import. See docs/musl-compatibility.md -->
+                    <configureArg>LDFLAGS=-L${boringsslBuildDir} -Wl,--gc-sections -lssl -lcrypto -ldecrepit -l:libstdc++.a -l:libgcc.a -l:libgcc_eh.a</configureArg>
                   </configureArgs>
                 </configuration>
               </execution>
 
@@ -102,6 +102,9 @@ Error relocating <lib>.so: __getauxval: symbol not found
 | `__isinf`, `__isnan` | APR-era glibc math aliases | no |
 | `__strdup` | APR | no |
 | `__pthread_key_create` | APR | no — but it is imported **WEAK**, so it may stay unresolved harmlessly |
+| `__libc_single_threaded` | libstdc++ 11+ headers on glibc 2.32+ read this byte to skip atomic refcounting; C++ in BoringSSL imports it as a **data** symbol | no. Defined as `0`, the conservative value |
+| `__isoc23_strtol`, `__isoc23_strtoul`, `__isoc23_strtoull` | glibc 2.38+ redirects `strtol` and friends there under `_GNU_SOURCE`, and no `-D` switches it off; from APR, the static `libstdc++.a` and BoringSSL's libcrypto respectively | no. Forwarded to the plain names via asm labels (a literal `strtol()` in the fallback would be redirected too and recurse on musl) |
+| `_dl_find_object` | `libgcc_eh.a` from gcc 12 on, when built against glibc 2.35+, uses it to find `.eh_frame` while unwinding | no. Stub returns -1 ("not found"); nothing in the artifact throws |
 
 ### Class C — Class B inside an ELF init constructor → **JVM crash, not an exception**
 
@@ -438,6 +441,9 @@ Other notes:
   *before* hawtjni. Use the `native-jar` target (phase `package`) or `process-classes`.
 - Ant's `<exec>` does not echo silent commands, so absence of `strip`/`patchelf` output in the
   log does **not** mean they did not run. Verify on the artifact instead.
+- The FIPS profile links with `-Wl,--gc-sections`. Its newer BoringSSL drags in libstdc++'s
+  `std::random_device`, which nothing calls and which imports `arc4random` (glibc 2.36+, absent
+  from musl). Dropping the dead code removes the import, so no fallback is needed for it.
 - Link flags are set per profile and are duplicated: the x86_64 default profile sets
   `hawtjniLdflags` in the `ldflags-setup` antrun execution, while the FIPS and `linux-aarch64`
   profiles hardcode `LDFLAGS` in their hawtjni `configureArgs`. Changing one does not change the
 
@@ -147,4 +147,55 @@ TCN_MUSL_COMPAT char *__strdup(const char *str) {
     return strdup(str);
 }
 
+/*
+ * glibc 2.38 made strtol and friends C23-conformant under a new symbol version, and redirects
+ * every call to an __isoc23_* name whenever _GNU_SOURCE is defined, whatever -std says; no -D
+ * switches it off. Built on such a glibc, APR imports __isoc23_strtol, the static libstdc++
+ * __isoc23_strtoul and BoringSSL's libcrypto __isoc23_strtoull. musl exports only the plain
+ * names.
+ *
+ * The bodies must call the PLAIN symbols. A literal strtol() here is subject to the same
+ * redirect, so on musl it would resolve to this very function and recurse. The asm labels
+ * bind each reference to the unversioned name, which both libcs export.
+ *
+ * __restrict, not restrict: the Debian 7 image compiles with GCC 4.9, whose default is gnu90,
+ * where `restrict` is not a keyword.
+ */
+extern long tcn_plain_strtol(const char *, char **, int) __asm__("strtol");
+extern unsigned long tcn_plain_strtoul(const char *, char **, int) __asm__("strtoul");
+extern unsigned long long tcn_plain_strtoull(const char *, char **, int) __asm__("strtoull");
+
+TCN_MUSL_COMPAT long __isoc23_strtol(const char *__restrict nptr, char **__restrict endptr, int base) {
+    return tcn_plain_strtol(nptr, endptr, base);
+}
+
+TCN_MUSL_COMPAT unsigned long __isoc23_strtoul(const char *__restrict nptr, char **__restrict endptr, int base) {
+    return tcn_plain_strtoul(nptr, endptr, base);
+}
+
+TCN_MUSL_COMPAT unsigned long long __isoc23_strtoull(const char *__restrict nptr, char **__restrict endptr, int base) {
+    return tcn_plain_strtoull(nptr, endptr, base);
+}
+
+/*
+ * glibc 2.32+ exports this byte, and libstdc++ reads it (ext/atomicity.h) to skip atomic
+ * reference counting while a process is still single-threaded. The static libstdc++ imports
+ * it as a plain data symbol; musl has no such thing. Zero is the conservative value: "not
+ * single-threaded", so the atomic path is always taken, which is also the truth inside a JVM.
+ */
+TCN_MUSL_COMPAT char __libc_single_threaded = 0;
+
+/*
+ * glibc 2.35 added _dl_find_object, and libgcc_eh.a from gcc 12 on calls it to locate a
+ * frame's .eh_frame when unwinding. musl has no equivalent. Returning -1 means "no object
+ * found": a C++ exception would then terminate instead of propagating, and nothing in this
+ * library lets one escape. Declared with void * on purpose: the real struct only exists in
+ * glibc >= 2.35 headers and the release image is glibc 2.12.
+ */
+TCN_MUSL_COMPAT int _dl_find_object(void *address, void *result) {
+    (void) address;
+    (void) result;
+    return -1;
+}
+
 #endif /* __linux__ */
@@ -97,11 +97,13 @@ __ctype_b_loc __ctype_get_mb_cur_max __ctype_tolower_loc __ctype_toupper_loc
 __errno_location __fpclassify __fpclassifyf __fpclassifyl
 __h_errno_location __libc_start_main __signbit __signbitf __signbitl
 __stack_chk_fail __stack_chk_guard __tls_get_addr
+__isoc99_fscanf __isoc99_fwscanf __isoc99_scanf __isoc99_sscanf __isoc99_swscanf __isoc99_vfscanf
+__isoc99_vfwscanf __isoc99_vscanf __isoc99_vsscanf __isoc99_vswscanf __isoc99_vwscanf __isoc99_wscanf
 '
 
 # The fallbacks openssl-dynamic/src/main/c/musl_compat.c defines. Asserting these are *defined*
 # rather than undefined catches the compatibility file being dropped or excluded from the link.
-MUSL_COMPAT_SYMS='__getauxval fopen64 __isinf __isnan __strdup'
+MUSL_COMPAT_SYMS='__getauxval fopen64 __isinf __isnan __strdup __libc_single_threaded __isoc23_strtol __isoc23_strtoul __isoc23_strtoull _dl_find_object'
 
 rc=0
 MACHINE=$("$READELF" -h "$SO" 2>/dev/null | sed -n 's/.*Machine:[[:space:]]*//p')