Quick fix for fuzzying iOS on MacOS ?

Using p0tools I am able to run a simple program compiled for iOS, with a manual trick[1] though, because the amfi part does not seem to work anymore.
I patched TinyInst to use posix_spawnattr_set_platform_np(..., PLATFORM_IOS, ...) and jackalope is able to spawn the program, and with the manual trick, everything runs[2]. However, tinyinst does not ever detect the target function to be called, and if the program exits it complains with WARNING: Target function not reached, retrying with a clean process.

My question is if there is a simple fix for continuing this experiment, or if the nature of TinyInst does not allow to fuzz iOS-on-Mac binaries.

Thank you in advance.

[1] Manual trick: after the target program has been spawned in paused mode, keep Jackalope paused (using a getc() after the posix_spawn), and do the following with lldb:

0. attach to the target program
1. break set -n xpc_copy_entitlements_for_self, continue and hit the breakpoint
2. get the address of my_xpc_copy_entitlements_for_self (from interpose.c of p0tools )
3. re write $pc 0x100dce000 -- where the address is from step 2
4. continue and detach, tell Jackalope to continue
5. last note: for doing step 4. the program must wait some seconds to give time to jacklope to attach before starting the target function

[2] ./fuzzer -t 1000 -in in -out out -delivery shmem -target_module testcrashme -instrument_module crashme2_ios.dylib -target_method __Z4fuzzPc -nargs 1 -iterations 10000 -persist -loop -cmp_coverage -- ./testcrashme -m @@

The report uses p0tools/iOSOnMac, TinyInst's posix_spawnattr_set_platform_np(... PLATFORM_IOS, ...) change, and the Jackalope fuzzer command shown in the issue. First reproduce the target-function detection failure and compare it with the documented LLDB steps; done means establishing a supported path with a passing reproduction or documenting the limitation.