Global: addresses Copilot's review comments

src/detection/top/top_apple.c

@@ -10,8 +10,14 @@ const char* ffTopGetProcessSnapshot(FFlist* snapshots, FFTopTypes showTypes) {
     if (npids <= 0) {
         return "proc_listallpids(nullptr, 0) failed";
     }
-    FF_AUTO_FREE pid_t* pids = malloc((uint32_t) (npids + npids / 8 + 1) * sizeof(pid_t));
-    npids = proc_listallpids(pids, npids);
+    // `proc_listallpids` returns the number of pids, but it wants the size of the buffer in bytes:
+    // passing the count back would only let the kernel fill a quarter of it.
+    const int pidCapacity = npids + npids / 8 + 1;
+    FF_AUTO_FREE pid_t* pids = malloc((size_t) pidCapacity * sizeof(pid_t));
+    if (pids == nullptr) {
+        return "malloc() failed";
+    }
+    npids = proc_listallpids(pids, pidCapacity * (int) sizeof(pid_t));
     if (npids <= 0) {
         return "proc_listallpids(pids, bufferSize) failed";
     }
@@ -41,6 +47,10 @@ const char* ffTopGetProcessSnapshot(FFlist* snapshots, FFTopTypes showTypes) {
         item->startTime = proc.pbsd.pbi_start_tvsec * 1000u + proc.pbsd.pbi_start_tvusec / 1000u; // convert to ms
         item->threads = (uint32_t) proc.ptinfo.pti_threadnum;
 
+        // FF_LIST_ADD does not zero the element, and top.c subtracts both counters for every
+        // process it samples, whether or not they were collected.
+        item->bytesRead = 0;
+        item->bytesWritten = 0;
         if (showTypes & FF_TOP_TYPE_DISK) {
             struct rusage_info_v2 rusage;
             if (proc_pid_rusage(pid, RUSAGE_INFO_V2, (rusage_info_t*) &rusage) == 0) {

src/detection/wallpaper/wallpaper_apple.m

@@ -118,6 +118,11 @@ const char* ffDetectWallpaper(FFstrbuf* result) {
 
     if (@available(macOS 14.0, *)) {
         error = detectFromPlist(result);
+        if (error) {
+            // The plist is the authoritative source on Sonoma and later, but when it can not be read
+            // at all, NSWorkspace can still resolve a user-picked static image.
+            error = detectFromNSWorkspace(result);
+        }
     } else {
 #ifdef FF_HAVE_SQLITE3
         error = detectFromSQLite(result);