Looks like I got it. The Mach-O header is 32 bytes; immediately after that is a series of "load commands"; the sixth word of the header is the length of the load commands. So we can just add 32 and get the offset of the code segment.