fix(verify): make the executable mapping build on FreeBSD

Assisted-by: GLM 5.3 Flash

go.mod

@@ -2,4 +2,7 @@ module sourcedock.dev/petrbalvin/gasm-devkit
 
 go 1.27.1
 
-require golang.org/x/arch v0.30.0
+require (
+	golang.org/x/arch v0.30.0
+	golang.org/x/sys v0.48.0
+)

go.sum

@@ -1,4 +1,4 @@
-golang.org/x/arch v0.29.0 h1:8sSET5wB0+exBm0FGmOtdHMqjlRdV2DRD3/IV6OZgho=
-golang.org/x/arch v0.29.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8=
 golang.org/x/arch v0.30.0 h1:sB9h+1gRGa2+LauFSV0tm8bK1J2yo1bx6/Uyi/P6DTU=
 golang.org/x/arch v0.30.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=

verify/jit.go

@@ -19,6 +19,8 @@ import (
 	"fmt"
 	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // Executable maps a copy of code into a read-execute memory region suitable
@@ -49,8 +51,9 @@ func Map(code []byte) (*Executable, error) {
 	}
 	copy(mem, code)
 
-	// Remove write permission (W^X).
-	if err := syscall.Mprotect(mem, syscall.PROT_READ|syscall.PROT_EXEC); err != nil {
+	// Remove write permission (W^X).  x/sys carries Mprotect on every
+	// platform the package builds for; the stdlib syscall one is Linux-only.
+	if err := unix.Mprotect(mem, syscall.PROT_READ|syscall.PROT_EXEC); err != nil {
 		syscall.Munmap(mem)
 		return nil, fmt.Errorf("verify: mprotect: %w", err)
 	}