> 6 (line 135) isn’t looking up the Method for -methodSignatureForSelector: it’s looking up the Method for the selector argument passed to -methodSignatureForSelector:.

I see, that was me misunderstanding what's happening here. In any case, `NULL` is returned here, I suspect because `myFoo` doesn't actually implement that method but rather uses message forwarding when a message with that selector is sent to it.

> The direct superclass look up is designed to prevent the recursion you describe. The arguments to objc_msgSendSuper start the look up for -methodSignatureForSelector: in the super class of this object’s actual class (to take dynamic subclasses into account) thus bypassing the implementation of -methodSignatureForSelector: on the leaf-most subclass.

That is true, but the object being passed in as `obcj_super.receiver` is still an instance of the implementation class. The next time `newIMP` is called, `Class actualClass =  object_getClass(self)` on line 134 returns the same value it did on the previous recursion, whereas what I think you'd want is for it to return the "super" class. Thus, `.super_class = class_getSuperclass(actualClass)` just sets `objc_super.super_class` to the same object it did before, and we rinse/lather/repeat.

> could you write a test case which demonstrates the issue for me to debug with?

Easier said than done, but I'll start working on one. :)