http://lkiw4tmbudbr43hbyhm636sarn73vuow77czzohdbqdpjuq3vdzvenyd.onion/article/shawn-webb/2023-08-07/hardenedbsd-july-2023-status-report
I started on this work well over a decade ago (it has roots back to ideas I had in 2003.) The project is aptly named libhijack[0]. One common technique is to rely on shared memory-backed file descriptors, writing the shared object to the shmfd, lseek(shmfd,0,seek_set), then fdlopen(shmfd).