I'm slightly closer to understanding the problem. The value of errno is that of the last error *before* getgrouplist(3) was called, that is, getgrouplist return -1 but does not update errno.

And looking at Apple source code this is a bug in CPython after all: getgrouplist(3) return -1 when the buffer is too small, but does not set errno (see <https://opensource.apple.com/source/Libc/Libc-262/gen/getgrouplist.c.auto.html>). The manpage also doesn't mention setting errno.

I'm pretty sure that the use of posix_error() is wrong here. 

We're running into a similar issue as with getgroups: on macOS a user can be a member of more than NGROUPS_MAX groups.  Because of this I'm not yet sure of the correct fix for this issue.

The easy part is that the call to posix_error in the implementation of getgrouplist should be replaced by raising some other error (or possibly just setting errno to EOVERFLOW before calling posix_error()).

The harder part is what to do about the definition of MAX_GROUPS for this function. Either force it to a larger default on macOS, or add some code to increase the buffer size (because the user cannot select the size of buffer to use). The latter is annoyingly hard because the system gives no indication on what the correct buffer size should be.

BTW. The same is also true on other platforms with getgrouplist(), this is not a macOS specific issue other than that NGROUPS_MAX is bogus there.