Hi Team, It has been some time since we received an update on FB22931581. We have already updated the Feedback with our latest findings and supporting artifacts, which indicate that the Trellix products, including the Self Protection feature, are not contributing to the issue. Could we please get some assistance in reviewing the latest findings and progressing the investigation?

Thank you for the explanation. Based on our observations so far, the behavior appears to be machine-specific rather than a one-time transient failure.The issue is not observed on all systems running the same macOS version. However, on the subset of affected systems, repeated installation attempts result in the same failure signature during the file commit phase: PKInstallErrorDomain Code=120 NSPOSIXErrorDomain Code=1 ("Operation not permitted") with the failure occurring during the _relinkFile operation involving an existing CodeResources file. I have also logged a FB - https://feedbackassistant.apple.com/feedback/22931581