This could be a memory corruption issue. /bin/sh behaves unpredictably when it encounters nul characters inside single quotes. Sometimes scripts that do this will work and sometimes they don't. When they don't work it'll usually prints garbled data:
ktrace reveals that $PATH search uses clobbered memory after parsing a single quoted string with NUL characters:
11172 1 sh CALL read(0xc,0x11f62e180,0x3f8)
11172 1 sh GIO fd 12 read 1016 bytes
"MZqFpD='\n\0\0\^P\0\M-x\0\0\0... etc.
\M-L\M-{\^N\^_\M-h\0\0^\M^A\M... etc.
\0U\M-*'\n#'\"\no=\"$(command -v \"... etc.
11172 1 sh RET read 1016/0x3f8
11172 1 sh CALL mmap(0,0x1000,PROT_READ|PROT_WRITE,0x1002<PRIVATE,ANONYMOUS,ALIGN=NONE>,0xffffffff,0,0)
11172 1 sh RET mmap 126131311058944/0x72b73bfda000
11172 1 sh CALL __stat50(0x11f62e7f0,0x7f7fffbbe840)
11172 1 sh NAMI "/root/bin/r���PQ<86>�����1۰^A�^B�^SYXr^]<8C>�<83>�"
11172 1 sh RET __stat50 -1 errno 2 No such file or directory
11172 1 sh CALL __stat50(0x11f62e7f0,0x7f7fffbbe840)
11172 1 sh NAMI "/sbin/r���PQ<86>�����1۰^A�^B�^SYXr^]<8C>�<83>�"
11172 1 sh RET __stat50 -1 errno 2 No such file or directory
11172 1 sh CALL __stat50(0x11f62e7f0,0x7f7fffbbe840)
11172 1 sh NAMI "/usr/sbin/r���PQ<86>�����1۰^A�^B�^SYXr^]<8C>�<83>�"
11172 1 sh RET __stat50 -1 errno 2 No such file or directory
As for execve() + ENOEXEC safety restrictions, I have no opinion or need for those.
check that a line exists before the first NUL character containing a lowercase letter.
APE binaries always start with "MZqFpD=\n" so it won't impact this use case. See:
