Ok, I've found the reason, i guess it's a bug. target_argv pointer is placed in bprm->argv; But then target_argv is freed and nullified.
loader_exec should just allocate a new char** and copy target_argv. I tried that and it worked. The problem is, where do I free() it? Am i supposed to do it or the TaskState lifecycle matches the executable (so there is no need to free() it) ? -- Fabio Erculiani