Index: /trunk/src/VBox/Runtime/r3/posix/process-creation-posix.cpp
===================================================================
--- /trunk/src/VBox/Runtime/r3/posix/process-creation-posix.cpp	(revision 92617)
+++ /trunk/src/VBox/Runtime/r3/posix/process-creation-posix.cpp	(revision 92618)
@@ -563,5 +563,5 @@
         && (!(fFlags & RTPROC_FLAGS_ENV_CHANGE_RECORD) || RTEnvExistEx(hEnv, "TMPDIR")) )
     {
-        char szValue[_4K];
+        char szValue[RTPATH_MAX];
         size_t cbNeeded = confstr(_CS_DARWIN_USER_TEMP_DIR, szValue, sizeof(szValue));
         if (cbNeeded > 0 && cbNeeded < sizeof(szValue))
@@ -690,4 +690,5 @@
  *          can guess to accurately up front, so we don't do any guessing and
  *          hope everyone is sensible and use UTF-8.
+ *
  * @param   hEnvToUse       The basic environment to extend with what we manage
  *                          to parse here.
@@ -810,10 +811,10 @@
  * @returns IPRT status code.  Not all error statuses will be returned and the
  *          caller should just continue with whatever is in hEnvToUse.
+ *
  * @param   hEnvToUse   On input this is the basic user environment, on success
  *                      in is fleshed out with stuff from the login shell dump.
- * @param   pszAsUser   The user name for the profile.  NULL if the current
- *                      user.
- * @param   uid         The UID corrsponding to @a pszAsUser, ~0 if NULL.
- * @param   gid         The GID corrsponding to @a pszAsUser, ~0 if NULL.
+ * @param   pszAsUser   The user name for the profile.
+ * @param   uid         The UID corrsponding to @a pszAsUser, ~0 if current user.
+ * @param   gid         The GID corrsponding to @a pszAsUser, ~0 if current user.
  * @param   pszShell    The login shell.  This is a writable string to avoid
  *                      needing to make a copy of it when examining the path
@@ -1047,4 +1048,7 @@
 static int rtProcPosixCreateProfileEnv(PRTENV phEnvToUse, const char *pszAsUser, uid_t uid, gid_t gid, uint32_t fFlags)
 {
+    /*
+     * Get the passwd entry for the user.
+     */
     struct passwd   Pwd;
     struct passwd  *pPwd = NULL;
@@ -1058,4 +1062,7 @@
     if (rc == 0 && pPwd)
     {
+        /*
+         * Convert stuff to UTF-8 since the environment is UTF-8.
+         */
         char *pszDir;
         rc = RTStrCurrentCPToUtf8(&pszDir, pPwd->pw_dir);
@@ -1078,9 +1085,11 @@
                 if (RT_SUCCESS(rc))
                 {
+                    /*
+                     * Create and populate the environment.
+                     */
                     rc = RTEnvCreate(phEnvToUse);
                     if (RT_SUCCESS(rc))
                     {
                         RTENV hEnvToUse = *phEnvToUse;
-
                         rc = RTEnvSetEx(hEnvToUse, "HOME", pszDir);
                         if (RT_SUCCESS(rc))
@@ -1090,22 +1099,25 @@
                         if (RT_SUCCESS(rc))
                             rc = RTEnvSetEx(hEnvToUse, "LOGNAME", pszAsUser);
-
                         if (RT_SUCCESS(rc))
                             rc = RTEnvSetEx(hEnvToUse, "PATH", pPwd->pw_uid == 0 ? _PATH_STDPATH : _PATH_DEFPATH);
-
+                        char szTmpPath[RTPATH_MAX];
                         if (RT_SUCCESS(rc))
                         {
-                            RTStrPrintf(achBuf, sizeof(achBuf), "%s/%s", _PATH_MAILDIR, pszAsUser);
-                            rc = RTEnvSetEx(hEnvToUse, "MAIL", achBuf);
+                            RTStrPrintf(szTmpPath, sizeof(szTmpPath), "%s/%s", _PATH_MAILDIR, pszAsUser);
+                            rc = RTEnvSetEx(hEnvToUse, "MAIL", szTmpPath);
                         }
-
 #ifdef RT_OS_DARWIN
+                        /** @todo r=bird: we should do this for pszAsUserFree == NULL too! */
                         if (RT_SUCCESS(rc) && !pszAsUserFree)
                         {
-                            size_t cbNeeded = confstr(_CS_DARWIN_USER_TEMP_DIR, achBuf, sizeof(achBuf));
-                            if (cbNeeded > 0 && cbNeeded < sizeof(achBuf))
+                            /* We put the "wrong" TMPDIR here now and then let
+                               rtProcPosixAdjustProfileEnvFromChild fix it later on. See
+                               https://opensource.apple.com/source/Libc/Libc-997.1.1/darwin/_dirhelper.c
+                               for the implemntation of this query. */
+                            size_t cbNeeded = confstr(_CS_DARWIN_USER_TEMP_DIR, szTmpPath, sizeof(szTmpPath));
+                            if (cbNeeded > 0 && cbNeeded < sizeof(szTmpPath))
                             {
                                 char *pszTmp;
-                                rc = RTStrCurrentCPToUtf8(&pszTmp, achBuf);
+                                rc = RTStrCurrentCPToUtf8(&pszTmp, szTmpPath);
                                 if (RT_SUCCESS(rc))
                                 {