“The ping(1) binary does not call execve(2) or fork(2). So now you can’t ever call fork() or execve() because there is no “syscall” instruction for those two system calls.”
OpenBSD now records where every syscall instruction lives in libc and ld.so, and the kernel refuses system calls from anywhere else. A static binary can only make the calls it was linked with. An attacker who hijacks ping can’t spawn a shell, because ping never had the instruction to begin with. De Raadt admits it stops nothing outright and only makes exploits more fragile. Attackers now need an OpenBSD-only playbook, and that cost is the point.