I think I finally understand what is going on and ready to make what I believe is a reasonable proposal.

Setting _DARWIN_C_SOURCE (or _DARWIN_UNLIMITED_GETGROUPS) replaces getgroups with a Darwin extension, but does not change setgroups:

$ nm tg1 | grep etgroups
                 U _getgroups
                 U _setgroups
$ nm tg2 | grep etgroups
                 U _getgroups$DARWIN_EXTSN
                 U _setgroups

(here tg2 is compiled with -D_DARWIN_C_SOURCE=1)

The extended getgroups$DARWIN_EXTSN is not getgroups at all and instead is effectively a call to getgrouplist(getpwuid(..)->pw_name, ..).  In other words, it reads the system database instead of the per-process list. (This also explains the choice made in Apple patch.)

This means that _DARWIN_C_SOURCE is not appropriate for posixmodule.c.

My recommendation is now to close this bug by reverting _DARWIN_C_SOURCE setting locally in posixmodule.c or globally in pyconfig.h in favor of more targeted settings in the modules that need Darwin extensions.

This will leave a feature request to add os.getgrouplist() for users who actually want to read the system database instead of per-process group list.

The other ideas related to allocation of grouplist buffer can be left as a "resource usage" issue.

Lack of support for more than 16 groups in OSX get/setgroups() should be left for Apple to take care of.  This limitation can be documented possibly as a conditional appendix to get/setgroups() docstrings.