(Also I'm not sure that the pid address write in reap_thread() is correct since I think it's supposed to write a pointer, not a pid_t, but for now I'm leaving this the same as it was before.)

I'm pretty sure it writes a pid_t. From man set_tid_address:

When set_child_tid is set, the very first thing the new thread does is to write its thread ID at this address.
...
When a thread whose clear_child_tid is not NULL terminates, then, if the thread is sharing memory with other threads, then 0 is written at the address specified in clear_child_tid and the kernel performs the following operation

(Also I'm not sure that the pid address write in reap_thread() is correct since I think it's supposed to write a pointer, not a pid_t, but for now I'm leaving this the same as it was before.)

I'm pretty sure it writes a pid_t. From man set_tid_address:

When set_child_tid is set, the very first thing the new thread does is to write its thread ID at this address.
...
When a thread whose clear_child_tid is not NULL terminates, then, if the thread is sharing memory with other threads, then 0 is written at the address specified in clear_child_tid and the kernel performs the following operation

Ah okay, I think I was getting confused by the prctl PR_GET_TID_ADDRESS, which writes the value of the ForeignPtr pointer (not the value pointed to by the ForeignPtr). I'll make a PR to try and add types here.