Some sanitizers use mach_vm_region_recurse on macOS to find a
sufficiently large gap to allocate shadow memory. Some sandboxes do not
allow this.
When we get KERN_DENIED, we suggest to the user that it may have been
blocked by the sandbox.
For error codes other than KERN_INVALID_ADDRESS and KERN_DENIED, we make
sure to log a message and not use the address.
rdar://160625998