For instance the X server crashes on fvwm startup, or mupdf crashes, when /run is served by a tmpfs.

What happens is that they create an shm (shmget, thus a file in /run/shm/, backed by tmpfs), then map it (shmat, i.e. open/mmap/close of the file), then remove access to it (shmctl(IPC_RMID), i.e. unlink the file).

The issue is that even if the file is still mapped, unlinking it from tmpfs makes tmpfs mach_port_deallocate the memobj, which apparently drops the object completely, and subsequent accesses to the mmap thus fail with SIGBUS. We'd need a way for tmpfs to know about the mappings of the pager object, to avoid shutting it down. Or a way to keep the object alive even if tmpfs has deallocated its port to it.