>> Using the native errno instead of a custom TLS value is bad because a
>> lot of things can occur
> 
> So what's the semantics of set_errno then? Set the real errno? If so,
> what if it gets changed between the call to set_errno, and the actual
> invocation of API function? Set the TLS errno? If so, when does it get
> copied into the real errno?

AFAIU, set_errno/get_errno should provide a ctypes-private copy of the real errno.
The copy is copied into the 'real' errno just before ffi_call (in Modules/_ctypes/callproc.c),
and the real errno is copied in to ctypes copy right after the call.

Probably the real errno from before this action should be restored at the end.

Code that I have in mind:

__thread int _ctypes_errno; /* ctypes-private global error number in thread local storage */

static int _call_function_pointer(...)
{
   int old_errno;
   .
   .
   old_errno = errno;
   errno = _ctypes_errno;
   ffi_call(....);
   _ctypes_errno = errno;
   errno = old_errno;
   .
   .
}

static PyObject *
_ctypes_set_errno(PyObject *self, Pyobject *args)
{
    .
    _ctypes_errno = parsed_argument;
    .
}

static PyObject *
_ctypes_get_errno(PyObject *self, Pyobject *args)
{
    return PyInt_FromLong(_ctypes_errno);
}