homepage

I think I finally understand what is going on and ready to make what I believe is a reasonable proposal.
Setting _DARWIN_C_SOURCE (or _DARWIN_UNLIMITED_GETGROUPS) replaces getgroups with a Darwin extension, but does not change setgroups:
$ nm tg1 | grep etgroups
 U _getgroups
 U _setgroups
$ nm tg2 | grep etgroups
 U _getgroups$DARWIN_EXTSN
 U _setgroups
(here tg2 is compiled with -D_DARWIN_C_SOURCE=1)
The extended getgroups$DARWIN_EXTSN is not getgroups at all and instead is effectively a call to getgrouplist(getpwuid(..)->pw_name, ..). In other words, it reads the system database instead of the per-process list. (This also explains the choice made in Apple patch.)
This means that _DARWIN_C_SOURCE is not appropriate for posixmodule.c.
My recommendation is now to close this bug by reverting _DARWIN_C_SOURCE setting locally in posixmodule.c or globally in pyconfig.h in favor of more targeted settings in the modules that need Darwin extensions.
This will leave a feature request to add os.getgrouplist() for users who actually want to read the system database instead of per-process group list.
The other ideas related to allocation of grouplist buffer can be left as a "resource usage" issue.
Lack of support for more than 16 groups in OSX get/setgroups() should be left for Apple to take care of. This limitation can be documented possibly as a conditional appendix to get/setgroups() docstrings.