I appreciate the additional clarification. Right now I'm focusing on getting the ES and NE extensions working from within the same system extension bundle; I'm not doing any explicit XPC (and I don't intend to use Mach messaging directly — I'm just trying to make sense of the system log messages). I'll make sure the service name is entered in only one place (under the NetworkExtension section). Thanks again.

Quinn, thank you for another quick and informative answer (and for explaining the change in the man page text). If I were in charge, you would never have to pay for a beverage again. ;-) A couple of quick clarifications: I haven't implemented any XPC listeners yet; it's more how I'm thinking about the low-level messages I'm seeing that refer to Mach service names and the like. That said, when I wrote "a single XPC listener for both, using the same service name under each key", I meant that I would enter the service name for the single listener under both keys in the Info.plist file. It seems clear to me that multiple listeners need unique service names for each. You've summarized quite well the tradeoffs of single vs. multiple sysexen. In the case where both subsystems feed events to a common module, a single sysex seems like the better choice. Thanks again for your assistance.