我试图理解在启动守护进程（以root身份运行）和另一个进程（以user-content运行）之间使用Mach messages进行IPC的底层机制。
假设使用以下数据结构：

struct MACH_MSG_BASE
{
    mach_msg_header_t hdr;
    mach_msg_body_t body;
};

struct MACH_MSG_UINT32
{
    MACH_MSG_BASE base;
    
    unsigned int val;      //Sending this value as a test
};

因此，我在守护进程中运行以下代码：

//Server:

//No error checks for brevity
mach_port_t port = MACH_PORT_NULL;
mach_port_t task = mach_task_self();

mach_port_allocate(task,
                   MACH_PORT_RIGHT_RECEIVE,
                   &port);

mach_port_insert_right(task,
                       port,
                       port,
                       MACH_MSG_TYPE_MAKE_SEND);

MACH_MSG_UINT32 msg = {};
msg.base.hdr.msgh_local_port = port;
msg.base.hdr.msgh_size = sizeof(msg.base);
        
mach_msg(&msg.base.hdr,
         MACH_RCV_MSG,
         0,
         sizeof(msg),
         port,
         MACH_MSG_TIMEOUT_NONE,
         MACH_PORT_NULL);

当我运行上面的代码时，它在mach_msg调用时进入等待模式，正如我所预料的那样。
但是，第一个问题是-如何从另一个进程获取守护进程的端口号？我假设使用task_for_pid，如下所示：

//Client(s):

//No error checks for brevity
mach_port_t port = MACH_PORT_NULL;
mach_port_t task;
task_for_pid(mach_task_self(), server_pid, &task);  //I guess we get server_pid by daemon process name?

mach_port_allocate(task,
                   MACH_PORT_RIGHT_RECEIVE,
                   &port);

MACH_MSG_UINT32 msg = {};
    
msg.base.hdr.msgh_remote_port = _port;
msg.base.hdr.msgh_local_port = MACH_PORT_NULL;
msg.base.hdr.msgh_bits = MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MAKE_SEND);
msg.base.hdr.msgh_size = sizeof(msg.base);
    
msg.val = 0x12345678;
    
mach_msg(&msg.base.hdr,
         MACH_SEND_MSG,
         sizeof(msg),
         0,
         MACH_PORT_NULL,
         MACH_MSG_TIMEOUT_NONE,
         MACH_PORT_NULL);

但是当我运行上面的代码时，mach_msg返回0x 10000003或MACH_SEND_INVALID_DEST。
我哪里做错了？