Hi all, I've run into a kernel deadlock issue involving content filter + VPN system/network extension on macOS 26, and would really appreciate any insights. A user reported that their mac is occasionally assigened a 169.254.0.0/16 address and can't reach any website after connecting Wi-Fi. Disabling our content filter restores network connectivity immediately. They're running the following software on the mac: macOS 26 (issue reproduced on 25C56 and 25F71) NEFilterDataProvider-based content filter (our extension) VPN network extension A spindump taken while the system had lost network connectivity shows the content filter's process stuck while delivering an "allow" verdict to the kernel. All subsequent flow decisions for the extensions are blocked behind it, which would explain why new DHCP request can't complete and the interface stays on a self-assigned address. Based on the "last ran" and timestamp in the spindump, the underlying deadlock appears to have occurred while the computer wasn't connected to any Wi-Fi network, so there was no visible symptom at the time. The user only noticed something was wrong once they tried to reconnect and saw the bad IP address; they did not realize the content filter was already stuck. This issue may be identified by searching for keyword "sofreelastref" in the spindump (see comment below). Has anyone else seen a content filter + VPN hang like this on macOS 26? Any guidance or pointers would be greatly appreciated. Thanks in advance! For Developer Technical Support staffs: FB23720745 Shay

Hi all. I'm exploring the new URL Filter framework that supports filtering URLs in encrypted HTTPS traffic. I'm particularly interested in understanding how we can leverage this in System Extensions on macOS. Can URL Filter be implemented within a macOS System Extension? The documentation seems to focus primarily on iOS implementations. I've attempted to evaluate the "Filtering traffic by URL" sample code by running PIRService on localhost (tried both macOS native binary, and Linux container) and SimpleURLFilter on the iOS simulator (26.0 23A5260l). However, the app fails to apply the configuration with NetworkExtension.NEURLFilterManager.Error 8, and PIRService doesn't receive any requests. Is this functionality supported in the simulator environment? Does Keyword Private Information Retrieval support pattern matching or wildcards? For example, would it be possible to create rules that block URLs like "object-storage.example[.]org/malicious-user/*"? Regarding enterprise use cases: While I understand URL filtering uses Private Information Retrieval to enhance user privacy, enterprise security teams often need visibility into network traffic for security monitoring and incident response. Are there supported approaches for enterprises to monitor HTTPS URLs? Any insights or clarification would be greatly appreciated. Shay

Hi all, It's nice that macOS 15 allows users to control System Extensions in "Login Items & Extensions", but I am encountering some issues in determining if a user has disabled or removed a System Extension. I will share my findings (as of macOS 15.1 24B5009l) for two scenarios and would appreciate any suggestions for better approaches. Scenario 1: During first-time activation, there is no clear API to determine if the user uninstalls the extension before activation. The code creates activationRequestForExtension:queue: and receives notifications via a delegate implementing OSSystemExtensionRequestDelegate. However, if the user does not authorize the activation of the System Extension and uninstalls it, the code receives request:didFailWithError: with error code OSSystemExtensionErrorRequestSuperseded. This error code is ambiguous, so I plan to submit a propertiesRequestForExtension:queue: and check the properties for each instance to determine if the user uninstalled the extension. Scenario 2: After activation, it is unclear when the user enables or disables the extension. It is somewhat easier in the enabled -> disabled scenario. The XPC connection will be invalidated, allowing me to submit another propertiesRequestForExtension:queue: in the XPC invalidation handler and check the result. However, I am having trouble with the disabled -> enabled scenario. There is no event or trigger indicating that the user has enabled the extension, so I have to submit propertiesRequestForExtension:queue: repeatedly at short intervals, which is not ideal. I wonder if there are better approaches. Any suggestions would be greatly appreciated. Thanks & regards, Shay