The es\_copy\_message function is deprecated and there are no alternatives provided. https://developer.apple.com/documentation/endpointsecurity/3228861-es_copy_message Currently, we copy incoming messages so that we can respond to messages later on a different dispatch queue/thread. Is there a change in ownership of incoming messages or is there something that I am missing here?

Hi, Our product in some cases requires taking snapshot of files being opened (especially in write mode). With endpoint security we are observing deadlock on macOS 11 open a file from smb share using Finder in application, in open auth callback use copyfile api with COPYFILE\_ALL flag this copyfile api is stuck until the open auth callback is not responded to. spindump shows copyfile stuck in kernel in smbfs stack. copyfile with COPYFILE\_METADATA i.e. just metadata seems to work fine. we are seeing more such issues on smb/nfs network shares. The same code works well on macOS 10.15. Is anyone else seeing similar issues? Are there significant changes in network shares in macOS 11? Thanks.