Update: I haven't figured out reproduction steps. After closing and reopening Firefox, it started producing audit tokens just fine. I proceeded to restart macOS to see if I could trigger the issue again, but now audit token are always present. Now I'm wondering if this has anything to do with uptime or long-running processes. The issue was present when macOS had over 5 days of uptime. I'll observe for the next few days, but if anyone has any idea what could the issue be, how to reproduce or anything like it, I'm still interested!

The issue can be reproduced with SimpleFirewall + SIP disabled. No flows despite being successfully installed. Another machines: I don't have a spare Mac at the moment. I'm trying to test with a clean VM via VirtualBuddy + macOS 15.1, but I'm having difficulties getting my app to run in there. I tried to add the VM uuid into Certificates, Identifiers & Profiles but it looks like it's in a different format and the form doesn't let me add the device, which blocks the Archive > Debug path to test the app (ticket). I'm now trying the Developer ID path. Any tips/resources on running dev apps on clean VMs would be greatly appreciated, if any available :)

Turning the firewall off fixes the issue. Content filter starts receiving and filtering flows again. Everything works fine. Turning the firewall back on stops working again. Idea from "Do they have the built-in firewall enabled? If so, does disabling it, and then restarting, cure this problem?" #768656

On VMs: thanks for the tips. I did the same, but I'm unable to register a new device in my account. The Provisioning UDID looks off. Tried with VirtualBuddy and UTM, open to suggestions. By the way I'm picking macOS in the device dropdown. Back to the real issue: will file a bug and post the bug number here. Thanks!

[quote='814382022, DTS Engineer, /thread/768706?answerId=814382022#814382022'] Please posting your bug number, just for the record. [/quote] FB15879569 Network extension does not work with firewall enabled and SIP disabled FB15876115 Malformed Provisioning UUID for VMs with macOS 15.1 as host I'm also on Apple silicon (M1), same UTM version, also macOS 15.1 as guest, but I'm on macOS 15.1 24B83 as the host. I keep getting Provisioning UDIDs in the VM that are not accepted in the Developer website. Filed a bug and included system reports from the host and VM.