No, I am not able to reproduce it, few customers reported it after deployed our app. I shared few system diagnose logs in the FB ticket.

Yes, our app was built on top of transparent proxy provider, we bypass DHCP from provider to make sure it communicates directly with its ultimate destination. However issue still been reported from customers when Transparent proxy extension running.

We saw this issue more with Content Filter and Transparent proxy network extension running on the device.

@DTS Engineer any update on this?

FB number FB22371512

No sure how to attach full system log here since it is large. Please let me know how to share the full system log if you need

2026-03-25 14:06:25.160810+0100 0x31ca3 Default 0x0 331 0 configd: (IPConfiguration) [com.apple.IPConfiguration:Server] DHCP en0: not supplying hostname 2026-03-25 14:06:25.160949+0100 0x31ca3 Info 0x0 331 0 configd: (IPConfiguration) [com.apple.IPConfiguration:Server] DHCP en0: busy 2026-03-25 14:06:25.162815+0100 0x31ca3 Info 0x0 331 0 configd: (IPConfiguration) [com.apple.IPConfiguration:Server] [en0] Transmit 300 byte packet xid 0xd1259f67 to 255.255.255.255 [scope=0] 2026-03-25 14:06:25.165760+0100 0x31ca3 Default 0x0 0 0 kernel: bpf26 attached to en0 by configd:331 2026-03-25 14:06:25.165867+0100 0x31ca3 Default 0x0 0 0 kernel: bpf26 closed and detached from en0 fcount 0 dcount 0 by configd:331 2026-03-25 14:06:25.166000+0100 0x31ca3 Default 0x0 331 0 configd: (IPConfiguration) [com.apple.IPConfiguration:Server] DHCP en0: INIT waiting at 0 for 1.680206 2026-03-25 14:06:26.849893+0100 0x31e79 Info 0x0 331 0 configd: (IPConfiguration) [com.apple.IPConfiguration:Server] [en0] Transmit 300 byte packet xid 0xd1259f67 to 255.255.255.255 [scope=0] 2026-03-25 14:06:26.853357+0100 0x31e79 Default 0x0 0 0 kernel: bpf26 attached to en0 by configd:331 2026-03-25 14:06:26.853489+0100 0x31e79 Default 0x0 0 0 kernel: bpf26 closed and detached from en0 fcount 0 dcount 0 by configd:331

The crash is not on demand. The code I post is very independent, it just load and release DS, why CFRelease crash even null was checked and release DS right after copy?

Is there any other system API or any other way to get process static code by skipping endpoint security check?