That's correct. networksetup is not launched by our code. It is launched by the VPN app not under our control. We are still trying to reproduce this issue, and will provide an update when we have any progress. Best regards, Shay

Hi Eskimo, I appreciate your input regarding this issue. We currently have remote access to one of the customer's computers. We plan to try reproducing this issue while disabling endpoint security clients. As you know, troubleshooting network issues remotely presents its own challenges. In parallel, I am setting up a simplified test environment with minimal network extensions, hoping to replicate the issue with the leanest possible code. I am still encountering difficulties getting App Proxy and Transparent Proxy working in this test setup. Regarding the networksetup processes running under Rosetta, they are launched by the VPN application. That app runs these commands every 5 seconds: networksetup -listnetworkserviceorder networksetup -listnetworkserviceorder networksetup -getdnsservers "Thunderbolt Bridge" networksetup -listnetworkserviceorder networksetup -getdnsservers Wi-Fi networksetup -listnetworkserviceorder networksetup -listnetworkserviceorder networksetup -getdnsservers "Thunderbolt Bridge" networksetup -listnetworkserviceorder networksetup -getdnsservers Wi-Fi I will provide an update as soon as we have further progress. Best regards, Shay

Symbolicated backtrace in kernel space: *1001 fleh_synchronous (in kernel.release.t8132) + 72 [0xfffffe0008857e38] *1001 sleh_synchronous (in kernel.release.t8132) (sleh.c:1484) [0xfffffe0008a18140] *1001 [^inline]handle_svc (in kernel.release.t8132) (sleh.c:0) [0xfffffe0008a18140] *1001 unix_syscall (in kernel.release.t8132) (systemcalls.c:181) [0xfffffe0008fad2ac] *1001 write (in kernel.release.t8132) (sys_generic.c:721) [0xfffffe0008e7a218] *1001 [^inline]write_nocancel (in kernel.release.t8132) (sys_generic.c:705) [0xfffffe0008e7a218] *1001 [^inline]write_internal (in kernel.release.t8132) (sys_generic.c:0) [0xfffffe0008e7a218] *1001 writev_internal (in kernel.release.t8132) (sys_generic.c:672) [0xfffffe0008e79f4c] *1001 fp_writev (in kernel.release.t8132) (sys_generic.c:596) [0xfffffe0008e79a44] *1001 soo_write (in kernel.release.t8132) (sys_socket.c:153) [0xfffffe0008e812e0] *1001 sosend (in kernel.release.t8132) (uipc_socket.c:2443) [0xfffffe0008eab414] *1001 ctl_send (in kernel.release.t8132) (kern_control.c:831) [0xfffffe0008e14750] *1001 cfil_ctl_send (in kernel.release.t8132) (content_filter.c:2089) [0xfffffe0008c68aa0] *1001 cfil_action_data_pass (in kernel.release.t8132) (content_filter.c:4869) [0xfffffe0008c69950] *1001 [^inline]cfil_set_socket_pass_offset (in kernel.release.t8132) (content_filter.c:4790) [0xfffffe0008c69950] *1001 cfil_service_inject_queue (in kernel.release.t8132) (content_filter.c:4560) [0xfffffe0008c6e044] *1001 cfil_sock_is_dead (in kernel.release.t8132) (content_filter.c:0) [0xfffffe0008c6eb10] *1001 in_pcbdetach (in kernel.release.t8132) (in_pcb.c:0) [0xfffffe0008ca5900] *1001 sofreelastref (in kernel.release.t8132) (uipc_socket.c:1066) [0xfffffe0008ea4b20] *1001 [^inline]sowflush (in kernel.release.t8132) (uipc_socket.c:4420) [0xfffffe0008ea4b20] *1001 sblock (in kernel.release.t8132) (uipc_socket2.c:2576) [0xfffffe0008eb5920] *1001 _sleep (in kernel.release.t8132) (kern_synch.c:0) [0xfffffe0008e51664] *1001 lck_mtx_sleep (in kernel.release.t8132) (locks.c:1170) [0xfffffe00088c473c] *1001 thread_block_reason (in kernel.release.t8132) (sched_prim.c:3825) [0xfffffe00088df314] *1001 thread_invoke (in kernel.release.t8132) (sched_prim.c:3208) [0xfffffe00088e0744]

spindump: Date/Time: 2026-07-08 13:20:56.218 -0400 End time: 2026-07-08 13:21:06.222 -0400 OS Version: macOS 26.2 (Build 25C56) Hardware model: Mac16,12 Process: network-extension-with-data-filter-provider [370] Thread 0x42e45 DispatchQueue "NEFilterExtensionProviderContext queue"(88) 1001 samples (1-1001) priority 37 (base 37) last ran 3136.683s ago 1001 start_wqthread + 8 (libsystem_pthread.dylib + 7068) [0x198b58b9c] 1001 _pthread_wqthread + 292 (libsystem_pthread.dylib + 11852) [0x198b59e4c] 1001 _dispatch_workloop_worker_thread + 692 (libdispatch.dylib + 85356) [0x1989b3d6c] 1001 _dispatch_root_queue_drain_deferred_wlh + 292 (libdispatch.dylib + 87156) [0x1989b4474] 1001 _dispatch_lane_invoke + 440 (libdispatch.dylib + 45048) [0x1989a9ff8] 1001 _dispatch_lane_serial_drain + 740 (libdispatch.dylib + 42216) [0x1989a94e8] 1001 _dispatch_client_callout + 16 (libdispatch.dylib + 113364) [0x1989baad4] 1001 _dispatch_call_block_and_release + 32 (libdispatch.dylib + 7004) [0x1989a0b5c] 1001 __63-[NEFilterFlow updateSourceAppInfoWithQueue:completionHandler:]_block_invoke_2 + 300 (NetworkExtension + 629016) [0x1ad72f918] 1001 __114-[NEFilterDataExtensionProviderContext handleData:offset:forFlow:direction:reply:controlSocket:completionHandler:]_block_invoke + 360 (NetworkExtension + 579396) [0x1ad723744] 1001 -[NEFilterDataSavedMessageHandler enqueueWithFlow:context:] + 172 (NetworkExtension + 575824) [0x1ad722950] 1001 -[NEFilterDataSavedMessageHandler executeWithFlow:context:] + 240 (NetworkExtension + 576128) [0x1ad722a80] 1001 -[NEFilterDataSavedMessageHandler executeVerdictHandlerWithFlow:verdict:context:] + 292 (NetworkExtension + 576608) [0x1ad722c60] 1001 __114-[NEFilterDataExtensionProviderContext handleData:offset:forFlow:direction:reply:controlSocket:completionHandler:]_block_invoke.145 + 132 (NetworkExtension + 580208) [0x1ad723a70] 1001 -[NEFilterSocketFlow createDataReply:controlSocket:direction:verdict:context:] + 328 (NetworkExtension + 616272) [0x1ad72c750] 1001 write + 8 (libsystem_kernel.dylib + 18464) [0x198b1e820] *1001 ??? (kernel.release.t8132 + 15928) [0xfffffe0008857e38] *1001 ??? (kernel.release.t8132 + 1851712) [0xfffffe0008a18140] *1001 ??? (kernel.release.t8132 + 7705260) [0xfffffe0008fad2ac] *1001 ??? (kernel.release.t8132 + 6447640) [0xfffffe0008e7a218] *1001 ??? (kernel.release.t8132 + 6446924) [0xfffffe0008e79f4c] *1001 ??? (kernel.release.t8132 + 6445636) [0xfffffe0008e79a44] *1001 ??? (kernel.release.t8132 + 6476512) [0xfffffe0008e812e0] *1001 sosend + 2692 (kernel.release.t8132 + 6648852) [0xfffffe0008eab414] *1001 ??? (kernel.release.t8132 + 6031184) [0xfffffe0008e14750] *1001 ??? (kernel.release.t8132 + 4278944) [0xfffffe0008c68aa0] *1001 ??? (kernel.release.t8132 + 4282704) [0xfffffe0008c69950] *1001 ??? (kernel.release.t8132 + 4300868) [0xfffffe0008c6e044] *1001 ??? (kernel.release.t8132 + 4303632) [0xfffffe0008c6eb10] *1001 ??? (kernel.release.t8132 + 4528384) [0xfffffe0008ca5900] *1001 sofreelastref + 804 (kernel.release.t8132 + 6621984) [0xfffffe0008ea4b20] *1001 ??? (kernel.release.t8132 + 6691104) [0xfffffe0008eb5920] *1001 ??? (kernel.release.t8132 + 6280804) [0xfffffe0008e51664] *1001 lck_mtx_sleep + 232 (kernel.release.t8132 + 460604) [0xfffffe00088c473c] *1001 ??? (kernel.release.t8132 + 570132) [0xfffffe00088df314] *1001 ??? (kernel.release.t8132 + 575300) [0xfffffe00088e0744] Thread 0x1016 1001 samples (1-1001) priority 31 (base 31) last ran 9867.252s ago 1001 _dispatch_sig_thread + 56 (libdispatch.dylib + 87768) [0x1989b46d8] 1001 __sigsuspend_nocancel + 8 (libsystem_kernel.dylib + 34060) [0x198b2250c] *1001 ??? (kernel.release.t8132 + 6281512) [0xfffffe0008e51928] Binary Images: 0x19899f000 - 0x1989e5e5f libdispatch.dylib (1542.0.4) <A4B349E8-DD6F-3B71-84D9-34F3B4ACD849> /usr/lib/system/libdispatch.dylib 0x198b1a000 - 0x198b5649f libsystem_kernel.dylib (12377.61.12) <548C45C8-9733-3F0D-8EF4-C06DF1DF2AD0> /usr/lib/system/libsystem_kernel.dylib 0x198b57000 - 0x198b63abb libsystem_pthread.dylib (539) <527C4BA0-91A5-378B-B3E2-D38269CA5A66> /usr/lib/system/libsystem_pthread.dylib 0x1ad696000 - 0x1ad9594ff com.apple.NetworkExtension 1.0 (1) <6A60134C-5DFF-3211-B643-5E92B788717B> /System/Library/Frameworks/NetworkExtension.framework/Versions/A/NetworkExtension *0xfffffe0008854000 - 0xfffffe00091bffff kernel.release.t8132 (25.2.0) <BE6139F8-2161-3F58-896B-68279E172031>__TEXT_EXEC /System/Library/Kernels/kernel.release.t8132

Hi all, I believe the behavior we're seeing is explained in the documentation "Using iCloud with macOS virtual machines" https://developer.apple.com/documentation/virtualization/using-icloud-with-macos-virtual-machines From the article: If someone moves a VM to a different Mac host and restarts it... Additionally, the Virtualization framework detects attempts to start multiple copies of the same VM simultaneously on the same Mac host... My interpretation of this is: The Virtualization framework will assign a new Secure Enclave-derived UDID if a VM is started on a different host. It will also assign a new UDID if a cloned VM is started on the same host while the original VM is running at the same time. Given these constraints, I don't think it's possible to reliably preserve a Secure Enclave-derived UDID across multiple cloned environments. However, at least for now, it's still possible to install macOS 15/26 using the older ChipID=0000FE00 style UDID. In my UTM workflow, the process looks like this: Locate en existing VM that uses the old UDID format (with the expected UDID), Create a new VM in UTM, but do not install macOS yet, quit UTM, Edit the new VM's config.plist, copy HardwareModel and MachineIdentifier from the old VM, I hope future versions of macOS will remain compatible with this old UDID format (DataRepresentationVersion=1), as it's currently the only practical method I'm aware of for preserving UDIDs. Shay

Hi Quinn, Thanks for your valuable information. Unfortunately I don't have experience with threat intelligence, and our threat intelligence team is also new to URL Filter and Private Information Retrieval. We are learning these technologies and will file enhancement requests if we need more from the OS frameworks. I filed FB18302351 for documentation improvement regarding question 3: The documentation itself needs to clarify the fuzzy matching behaviour of NEURLFilter. My colleague filed another feedback for question 4, I asked for the FB number but I haven't heard from him yet. Kindly Regards, Shay

I think you're testing connections to localhost (127.0.0.1 or ::1), which requires explicit network rules. Refer: NetworkExtensions/NENetworkRule.h If the address is a wildcard address (0.0.0.0 or ::) then the rule will match all destinations except for loopback (127.0.0.1 or ::1). To match loopback traffic set the address to the loopback address.

(..continued) NEFilterManager must be enabled after the System Extension is activated and enabled, it might be a disaster if NEFilterManager is enabled without a runnable System Extension (all network connection lost, or even T2 watchdog panic). A new status API/notification would help developer to implement this feature more easily.