Conceptual, architectural explainers — how a subsystem actually works underneath.
Understand io_uring queues, submissions, completions, workers, polling, resource registration, cancellation and security before benchmarking.
Distinguish global, cgroup, cpuset and policy-driven OOM events; interpret victim scoring and build memory controls from forensic evidence.
Understand Linux page-cache reads, buffered writes, dirty throttling and durability boundaries without confusing write completion with stable storage.
Trace Linux hardware from kernel device registration through sysfs, uevents, devtmpfs and udev rules to stable, collision-tested user-facing links.
Why you can't find most of macOS's own system libraries as individual files on disk anymore, and how the shared cache changed launch performance.
Apple's multi-year push to deprecate kernel extensions for user-space System Extensions and DriverKit, and what changes when a driver runs outside the kernel.
Why traditional plain-text syslog couldn't keep up with modern macOS, and how unified logging's structured, activity-tracing design fixes that.
Why macOS's kernel is neither a pure microkernel nor a pure monolithic kernel, and what that hybrid design actually buys in practice.
The IPC framework behind most of macOS's privilege separation, built on Mach IPC but designed to make secure, sandboxed communication the easy default.
Why emulator code, firmware, game images, dumping, distribution, and anti-circumvention are separate legal questions requiring local analysis.