The i386-linux getcontext.S uses the old, non-"rt" sigprocmask syscall, only filling in the first 32 signal bits and leaving uninitialized junk in the rest of the saved signal mask. This also breaks under seccomp rules that don't allow the obsolete (extremely ancient) version of the syscall, as discovered by @taviso and discussed on Twitter: https://twitter.com/taviso/status/1166763213339287553 In particular it breaks under the default Docker policy.