void exit(int status)
pid_t wait(int *stat_loc);

As already mentioned, only the low 8 bits of exit()'s int argument, status, are meaningful. The rest are practically ignored. However, it is an error to assume that the low 8 bits written by wait() to stat_loc are the low 8 of exit()'s status. This is often not the case. Since the layout of wait()'s *stat_loc bitmask is implementation dependent, POSIX specifies macros for examination and retrieval.

The 139 "exit status" in Gaurav's post isn't a true exit status. When a process exits abnormally, the bits which encode exit status have no meaningful value (which is why you are required to consult WIFEXITED() to confirm that the process exited normally before examining the exit status with WEXITSTATUS()).

If it's not an exit status, then what is it? If it wasn't an exit() argument, and if it wasn't main()'s return value, and if it's not provided by the kernel, then where does the 139 come from?

Before checking the exit status of it's child, the shell confirms that it exited normally, with WIFEXITED(). When the confirmation fails, the shell consults WIFSIGNALED(). Determining that the process was signaled and terminated abnormally, the signal number is retrieved with WTERMSIG(). By convention, the shell adds 128 to the signal number and stores that result in its ? parameter.

If your C code wait()ed on a process that was killed by that same signal, in the signal bits examined by WTERMSIG(), it would see 11 and not 139.

To avoid ambiguity, if you plan to invoke your binaries with the shell, it's a good idea to keep to exit values in the range 0 to 125 inclusive. The remaining values are spoken for: 126 (command found but not executable), 127 (command not found), and values larger than 128 (signal number + 128).

(Some of the following may be x86 specific.)

Returning to the original question: Where is the exit status stored? Inside the kernel.

When you call exit(n), the least significant 8 bits of the integer n are written to a cpu register. The kernel system call implementation will then copy it to a process-related data structure.

What if your code doesn't call exit()? The c runtime library responsible for invoking main() will call exit() (or some variant thereof) on your behalf. The return value of main(), which is passed to the c runtime in a register, is used as the argument to the exit() call.

When the parent calls wait(stat_loc), the exit status value (along with other status information) is copied from the kernel process structure to the address pointed to by wait()'s stat_loc.

Once a dead process is wait()'d on and its status information delivered, the kernel can destroy that process' data structure. Until then, the lingering data structure is the hallmark of a zombie.

Regards,
Alister