Thanks for the quick response! Is it helpful to file a radar for it?

I can confirm that by moving from NetService to NWBrowser/NWListener (as you suggest), you do get notified of this problem in the NWBrowser#stateUpdateHandler callback. This is very helpful for me, but I'm not sure how to check that a specific NWBrowser.State instance represents waiting(-65570: PolicyDenied). I can only see this information when I print the debugDescription or print the value in the LLDB console, but how do I check specifically that the state is PolicyDenied?