I'm also seeing consistent bandwidth-sharing problems on an iPhone 17 Pro where an iPhone 16e is okay, both running iOS 26.5. The scenario is the same as the others in this thread - 2 peripherals streaming data simultaneously. I've submitted detailed feedback with Bluetooth Log sysdiagnose dumps for both devices: FB22872281 In short what I'm seeing is: iPhone 16e: ~35/40 KB/s per peripheral, equal sharing iPhone 17 Pro: consistently ~16 KB/s for one peripheral, the other much faster My suspicion based on the data is that one of the two devices is being granted only one PDU per connection interval, however I don't have the hardware to verify that.

I sat down tonight and ran through this. Thanks for the super clear instructions! Good news: it works, and also works in my original app. Once I knew exactly what the MTE simulated crash report looked like I found two examples lurking among the dozens of crash reports from when I was testing a couple of weeks ago. This doesn't entirely make sense. I would have expected to see heaps more of them, and it's strange that real memory corruption crash reports vastly outnumber the MTE simulated ones. I like to think there was more to this than PEBKAC but at this point who could say? 😁 Thanks again!

Thanks Quinn, much appreciated. I'll add that I've also tried Soft Mode extensively and I've never seen it do anything. No log messages, no crashes in the debugger, no crash reports in the on-device logs for MTE. I'm open to suggestions! Occasionally I can get a crash in _zxm_xzone_malloc_free_outlined in an unrelated stack but this appears to be regular old corruption rather than MTE kicking in.

For the record, I've made no further progress triggering an MTE crash using only the entitlements. I tried a more extreme pointer manipulation and it still proceeds just fine: // Now guarantee a tag mismatch by modifying p2's tag unsigned old_tag = PTR_TAG(p2); unsigned new_tag = (old_tag + 1) % 16; uintptr_t addr_only = (uintptr_t)p2 & 0x00FFFFFFFFFFFFFF; void *p2_bad_tag = (void *)(addr_only | ((uintptr_t)new_tag << 56)); os_log(OS_LOG_DEFAULT, "Original tag: %u, Modified tag: %u\n", PTR_TAG(p2), PTR_TAG(p2_bad_tag)); os_log(OS_LOG_DEFAULT, "Attempting read with guaranteed bad tag...\n"); volatile char c2 = *(volatile char *)p2_bad_tag; // Should this crash? os_log(OS_LOG_DEFAULT, "Read succeeded! Value: %d\n", c2); yields Original tag: 14, Modified tag: 15 Attempting read with guaranteed bad tag... Read succeeded! Value: 31