Explore the core architecture of the operating system, including the kernel, memory management, and process scheduling.

Posts under Core OS subtopic

Post

Replies

Boosts

Views

Activity

Core OS Resources
General: DevForums subtopic: App & System Services > Core OS Core OS is a catch-all subtopic for low-level APIs that don’t fall into one of these more specific areas: Processes & Concurrency Resources Files and Storage Resources Networking Resources Network Extension Resources Security Resources Virtualization Resources Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"
0
0
1.6k
Aug ’25
CMIO system extension: sysextd "no policy" + code 4 on 26.5 — resolved in 27?
Is macOS 27 Public Beta 2 able to activate new non‑MDM CMIO system extensions that fail on macOS 26.5.2? I'm building a virtual-camera app with a CMIO camera system extension (Developer ID signed + notarized), for personal use on my own Macs — no MDM. On macOS 26.5.2 (25F80) I can't get a new activation to succeed, and I'm trying to find out whether macOS 27 resolves it. Two failure modes I've seen: With SIP enabled, OSSystemExtensionRequest reaches the daemon, then sysextd logs: "no policy, cannot allow apps outside /Applications" — even though the app is in /Applications (verified real path, single copy, running from there). This matches other reports (e.g. LuLu / network extensions). With SIP disabled + systemextensionsctl developer on, it now fails earlier, client-side, with OSSystemExtensionErrorDomain code 4 — "Extension not found in App bundle / Unable to find any matched extension with identifier" — the request never even reaches sysextd. Things I've already verified/ruled out: Product type com.apple.product-type.system-extension; extension embedded at Contents/Library/SystemExtensions/; matching CFBundleIdentifier and Team ID; CMIOExtensionMachServiceName = $(TeamIdentifierPrefix)$(bundle id). App has com.apple.developer.system-extension.install (with authorizing profile); shared App Group + camera entitlement on both app and extension. Valid codesign --deep --strict; notarized + stapled; single LaunchServices registration; running the correct bundle. Reproduces with both Developer ID and Apple Development signing, and running straight from Xcode with a signed-in account. So the app/extension appear structurally correct; this looks like an OS-side regression in 26.5.x. My question: Has anyone successfully activated a new Developer ID (non-MDM) CMIO / system extension on macOS 27 Golden Gate Public Beta 2? Is this sysextd / code‑4 activation regression fixed there, or is it still present? Trying to decide whether upgrading is worth it. Thank you!
0
0
3
1h
Apple Pencil Pairing Issues
Is anybody else having a probelm pairing an Apple Pencil. I insert it into my new 2gen iPad Pro 12.9 and it briefly shows the dialog to Pair and then shows it connected, but then disconnects, and then I get an Error that the Pencil took to long to pair. Then it doesn't work.Am I alone in having this issue.Thanks,Nick
31
0
51k
6h
FSKit - Retrieve Process ID?
Does FSKit support the ability to get the process information, such as the pid, when a process accesses a resource? Being able have the process context is important for implementing certain access patterns and security logging in some contexts. For instance, we have a system that utilizes (pre-FSKit) a FUSE mount that, depending on the process has different "views" and "access" based on the process id.
3
0
569
23h
CTCellularPlanStatus.checkValidity(ofToken:) throws Couldn't communicate with a helper application on iOS 26
Hello, We are using the UPI device validation APIs on iOS 26+ in a production banking/UPI app, and we are seeing a recurring failure from CoreTelephony that we need guidance on. API / entitlement Framework: CoreTelephony API: CTCellularPlanStatus.checkValidity(ofToken:) Related: CTCellularPlanStatus.token() Entitlement: com.apple.developer.upi-device-validation Availability: iOS 26.0+ Minimal call site do { let isValid = try await CTCellularPlanStatus.checkValidity(ofToken: token) // isValid == true/false -> expected outcomes } catch { // Unexpected: API throws instead of returning Bool print(error.localizedDescription) } Error error.localizedDescription is: English: Couldn't communicate with a helper application. Same failure also appears with a localized Hindi message on Hindi-locale devices. This is distinct from checkValidity(ofToken:) returning false (token/SIM mismatch). Here the API throws, so we cannot tell whether the token is valid. In production we currently only have this localizedDescription from telemetry. Production observations (large fleet, last few days) Observed only on production user devices so far; we have not reproduced it reliably on lab hardware. Occurs across multiple iOS 26.x builds (notably 26.5.2, 26.5, 26.6; also seen on 26.0-27.0). Not limited to a single patch. Seen on many iPhone models (not one SKU). Latency is bimodal for the same error string: large share fails in under 100 ms (immediate) another large share fails after about 2-10+ seconds (timeout-like) Observed under Wi-Fi, cellular (4G/5G), and No Connection / radio-not-ready conditions. Same device can emit many identical failures within about 1 second when validity is checked from multiple call sites concurrently. Token generation (CTCellularPlanStatus.token()) and successful checkValidity work for the vast majority of users; this throw is a smaller but material failure class. Questions for Apple Is "Couldn't communicate with a helper application." an expected / documented failure mode of checkValidity(ofToken:) (for example CommCenter/XPC unavailable, radio not ready)? What conditions typically trigger this error from checkValidity(ofToken:)? Recommended client handling: retry (with backoff)? treat as transient and skip forcing re-binding? surface to user? Does validation require cellular registration / SIM ready state even when docs indicate internet is not required? Any known issues on specific iOS 26.x builds, dual-SIM, eSIM, or airplane-mode transitions? Is concurrent checkValidity from multiple tasks unsupported / unsafe? Because this is currently production-only and not reliably reproducible on lab devices, we cannot attach a sysdiagnose or Instruments trace at this time. We can share aggregated production telemetry and API details via Feedback Assistant if helpful. Thank you.
0
0
38
1d
macOS 27 beta — TCC intermittently blocks file writes during postinstall (I/O errors when unpacking .app)
Our app uses a Distribution.xml-based installer. Within the postinstall script, we attempt to untar a signed and notarized .app to the /Applications directory. On macOS 27 (tested up to Developer Beta 4), the tar command randomly fails to write random unpacked files with an I/O error; in the console there is "spolicyd[721] revoked access to "/Applications/XXX.app/file/within". It can be reproduced approximately every 4th install. Is this happening for anyone else? Any known workaround?
2
1
100
1d
Removing or invalidating a BLE bond when the app is the peripheral (CBPeripheralManager)
Our iOS app runs in the peripheral role. A hardware accessory acts as the central: it connects to the app and bonds in order to read and write characteristics we declare with encryption-required permissions. The app advertises so a previously bonded accessory can reconnect on its own. The problem is that the bond lives on both sides and we can only clear one of them. The accessory has its own "forget this phone" function, and it can also be told to do so remotely. iOS keeps its half, and we have not found any way for the app to remove or invalidate it. What we've checked: CBPeripheralManager and CBCentral expose no unpair or unbond operation. A CBCentral is only visible while connected or subscribed, and its identifier is a resolved handle. Questions: Is there a supported way for an app in the peripheral role to remove or invalidate the pairing keys for a bonded central? If we've missed an API, please point us at it. If not, what's the recommended approach when the peer has discarded its keys and the bond is no longer usable? Can a peripheral-role app detect that state — a distinguishable error or connection event when encryption fails — so we can tell the user something accurate instead of a generic connection failure?
3
0
96
1d
FSEvents vs Endpoint Security Framework for a macOS file-operation audit product
I'm developing a macOS product that generates verifiable audit records of media-asset movement on endpoints, for professional media-production companies. It is not an antivirus or Data Loss Prevention product; it collects operating-system file-system events and converts them into tamper-evident audit evidence and audit reports. Target users need comprehensive endpoint audit trails for compliance with industry security standards, including Motion Picture Association Trusted Partner Network assessments. The product must reliably distinguish these operations: file copy, move, rename, and volume mount and unmount — including on external volumes. I've reviewed existing forum guidance, including Quinn's explanation that FSEvents only signals that "something changed" rather than the exact operation, and that it is designed around Spotlight and Time Machine semantics. In my own testing I've also seen inconsistent flags across cp, Finder copy, and application saves, and frequent kFSEventStreamEventFlagMustScanSubDirs events on external drives even when nothing along the path changed. Questions: Given the above, for an audit product that must reliably distinguish copy vs. move vs. rename, should FSEvents be treated as structurally unsuitable, with the Endpoint Security Framework adopted instead as the primary source? For capturing volume mount and unmount operations, is the Endpoint Security Framework the recommended source, or should this be combined with Disk Arbitration? Are there long-term supported APIs recommended for this type of endpoint audit product, to ensure compatibility with future macOS releases? Any recommended documentation, WWDC sessions, or sample code for this use case would be appreciated. For context, I'm building toward a System Extension using the Endpoint Security Framework and will file the entitlement request separately; this post is to confirm the architectural direction before committing. Thank you.
7
0
253
2d
Managed Apple ID works for iMessage on bare metal, but fails in macOS VM (same hardware)
Hi all, I'm running 2 macOS VMs on a bare-metal Mac (host is also macOS). I'm seeing inconsistent iMessage sign-in behavior depending on the Apple ID type and whether it's bare metal or virtualized: Managed Apple ID (ABM-issued): signs into iMessage fine on the bare-metal host. Same Managed Apple ID: fails to sign into iMessage inside the VM on the same physical machine. Personal/basic Apple ID: signs in fine in the VM without issue. Has anyone run into this specific combination — MAID working on bare metal but not inside a VM, while a personal ID works fine in both?
0
0
74
2d
com.apple.asam profile installs but is reported as "com.apple.unknown" on iOS 26.5.1 (ASAM not granted)
I'm trying to enable Autonomous Single App Mode (ASAM) for my own app on a supervised iPhone, but UIAccessibility.requestGuidedAccessSession(enabled:) always returns false, even though the com.apple.asam profile installs without error. Environment Device: iPhone 16 (iPhone18,5), iOS 26.5.1 Supervised: yes (verified via DeviceInformation query → IsSupervised = true) MDM: self-hosted NanoMDM. Other payloads (com.apple.webcontent-filter, com.apple.applicationaccess) install and work correctly. App: development-signed, Bundle ID net.self-control-mdm.SessionLock, Team ID 9VH4G6KS29 Profile I'm sending (matches the AutonomousSingleAppMode documentation exactly): What happens InstallProfile is Acknowledged with no ErrorChain. A ProfileList query shows the profile IS installed, but its payload type is reported as com.apple.unknown (display name is preserved). In Settings → General → VPN & Device Management, the profile shows the payload as "Unknown Payload". In the app, requestGuidedAccessSession(enabled: true) completion returns success = false. Rebooting the device does not change anything. Questions Is the legacy com.apple.asam profile payload still honored on iOS 26, or has ASAM authorization moved to Declarative Device Management? If DDM is now required, which declaration/configuration should I use to allow-list an app for ASAM? Does com.apple.unknown in the ProfileList response indicate the payload was genuinely not recognized, or is that expected for this payload type? Are there additional requirements on iOS 26 (e.g., the app must be an MDM-managed app, or a non-development signature) for requestGuidedAccessSession to succeed? Thanks in advance.
7
0
401
2d
Failure to mount an FSKit volume *sometimes*
Hello, I'm working on a project for a file system using FSKit and I'm currently experiencing a strange issue on macOS 26 to which I updated recently. While testing, I'm doing incremental debug builds using Xcode. I'm very careful to make sure I only have a single instance of the built app (hosting the file system extension) anywhere on disk. I run the app, mount the file system, run some tests, unmount, kill the app, make changes, and repeat. Once in a while, however, mount would suddenly start failing with mount: Loading resource: The operation couldn’t be completed. (com.apple.extensionKit.errorDomain error 2.) mount: File system named MyFS not found This would consistently repeat until I clean the build folder, rebuild and run again. I would continue testing for a while, then at some point mount would start failing again. I looked at the system logs and found this message from extensionkitservice: Failed to initialize _EXExtensionIdentity: Error Domain=com.apple.extensionKit.errorDomain Code=5 "Failed to find extension: 24B7F729-5AD1-4486-92B4-1F57CACCA265" So I started going through the logs in more detail and found the following: lsd seems to unregister and register the file system extension occasionally, each time giving it a different UUID. I can see logs about "com.apple.LaunchServices.pluginsregistered" and "com.apple.LaunchServices.pluginsunregistered" notifications being sent with their data. What seems to be the problem is that sometimes after this happens, when I attempt to mount the file system, the extensionkitservice would fail to find the extension because it is referencing it using one of its previous UUIDs assigned by lsd, not its latest one, judging by the UUID in the log message. Am I doing something wrong here? I think I may be causing the constant unregister/register of the extension idirectly by rebuilding via Xcode. Or is it a problem with extensionkitservice? I've never had this happen on Sequoia. macOS 26.0.1 (25A362); Xcode 26.0.1 (17A400) Thank you
5
1
724
3d
High Power Mode not applied by powerd after Migration Assistant (migrateenergyprefs related?)
High Power Mode setting is not applied by powerd (possibly related to migrateenergyprefs) Summary On a MacBook Pro (14-inch, M5 Max), enabling High Power Mode in System Settings has no effect on the actual power governor. The system continues to run at the default (Automatic-equivalent) power ceiling regardless of the High Power Mode setting. The same symptom has been reproduced on a different physical machine, a MacBook Pro (M4 Max), ruling out a single hardware defect. Environment Affected device: MacBook Pro 14-inch (Apple M5 Max, 12P+6S+40GPU, 128GB RAM) macOS version: macOS 26.5.1 (Build 25F80) Migration history: Intel Mac → MacBook Air (M2) → MacBook Pro (M4 Max) → MacBook Pro (M5 Max), using Migration Assistant at each step Same symptom also confirmed on the MacBook Pro (M4 Max), which had the same migration history Symptom Selecting "High Power" under System Settings → Battery → Power Mode has no effect on system_profiler SPPowerDataType, which always reports High Power Mode: No. pmset -g custom correctly shows powermode 2 (the High Power equivalent) for AC Power, confirming the user-facing setting is being written correctly. Low Power Mode in the same system_profiler output correctly toggles between Yes/No depending on the UI selection (Automatic / Low Power / High Power). Only High Power Mode fails to track the UI selection. Benchmarking with 3DMark Steel Nomad Stress Test (Metal API) reproduces the score pattern that third-party reviews report for High Power Mode OFF (stabilized score ~3100–3400), rather than the ON pattern reported for the same model (~3600+). This confirms the issue is not just cosmetic (a wrong status string) but reflects an actual difference in the power ceiling being enforced. Investigation steps taken 1. Preference file inspection Inspected /Library/Preferences/com.apple.PowerManagement.<UUID>.plist. Multiple UUID-keyed files exist, each corresponding to a previously used device (identified by battery serial number in the BatteryWarn key). All of them contained HighPowerMode = 0, including the file matching the current machine's serial number. The MacBook Air (M2) used earlier in this device's migration history does not support High Power Mode at all. It's suspected that HighPowerMode = 0 originated from that device and was carried forward through subsequent Migration Assistant transfers to devices that do support the feature, without ever being correctly re-evaluated. 2. Direct write test Used defaults write to directly set HighPowerMode = 1 in the relevant plist. system_profiler then reported High Power Mode: Yes, and this persisted across a reboot. However, a subsequent benchmark run showed no improvement — powermetrics Combined Power remained in the 27–30W range, and the Steel Nomad Stress Test stabilized score actually dropped slightly (~3134 average over the last 10 loops). This indicates the displayed value is decoupled from the actual power governor state. 3. File deletion / regeneration test Deleted the UUID-keyed plist (after backing it up) and let powerd regenerate it from scratch. The newly generated file still showed HighPowerMode stuck at No and unresponsive to UI changes, while LowPowerMode continued to track UI changes correctly. The same test was repeated with the non-UUID common file (com.apple.PowerManagement.plist), with no change in behavior. This rules out stale/corrupted preference data as the root cause. 4. Binary-level investigation Searched the system for files containing the string "HighPowerMode". Aside from unified logging symbol caches (uuidtext, not relevant), the following were found: /System/Library/CoreServices/powerd.bundle/powerd (Apple-signed, Signed Time: Apr 19, 2026, Platform identifier 26) /System/Library/CoreServices/powerd.bundle/migrateenergyprefs.bundle/ (com.apple.migrateenergyprefs, LSMinimumSystemVersion 26.5, built with Xcode 2630) /System/Library/SystemProfiler/SPPowerReporter.spreporter/ /System/Library/ExtensionKit/Extensions/BatterySettingsIntentsExtension.appex/ The presence of a dedicated com.apple.migrateenergyprefs component strongly suggests this is the code path responsible for carrying power preferences across device migrations. We suspect this migration logic fails to correctly initialize or re-evaluate HighPowerMode when migrating from a device that doesn't support the feature to one that does. Reproducibility Reproduced on two distinct physical machines (M4 Max and M5 Max), making a hardware fault unlikely. Reproduced after deleting and regenerating the preference files, ruling out simple cache corruption. Reproduced after a full reboot, ruling out a transient in-memory state issue alone. Impact Because High Power Mode is not actually engaged, sustained CPU/GPU performance under heavy load is capped at a lower power ceiling than intended, resulting in measurably lower benchmark scores and sustained performance compared to the documented behavior of the same hardware configuration. Questions for Apple Could the com.apple.migrateenergyprefs logic be reviewed for how it handles HighPowerMode when migrating from a device that does not support the feature (e.g., MacBook Air M2) to one that does? Is there a known issue with HighPowerMode specifically (as opposed to LowPowerMode, which behaves correctly) not being written back by powerd in response to UI changes? Are there other users with a similar multi-generation Migration Assistant history reporting the same symptom? Happy to provide a sysdiagnose or additional logs if useful.
16
1
762
3d
User created via VZMacGuestProvisioningOptions is not returned by CSIdentityQueryExecute()
This post applies to Apple Virtualization framework feature to setup a user account during VM setup (VZMacGuestProvisioningOptions) introduced in macOS 27: Issue: Creating a user via VZMacGuestProvisioningOptions during VM setup, results in a user which is not returned by CSidentityQueryExecute(). Same code executed on a macOS 26 VM or a macOS 27 VM where the user was created by hand within the VM (so without VZMacGuestProvisioningOptions) returns the user. How to reproduce: Create an VM via the Apple Virtualization framework and use the VZMacGuestProvisioningOptions to create the user during VM setup. I actually used Virtual Buddy and Tart to do this. Then run the following code: internal enum MyLogger { static let info = Logger(subsystem: Bundle.main.bundleIdentifier!, category: "Utils-\(getuid())") } public struct Identity { public let posixUID: id_t public let posixName: String init?(posixUID: id_t, posixName: String) { self.posixUID = posixUID self.posixName = posixName } } class Utils { public static func userIdentities() -> [Identity] { let defaultAuthority = CSGetLocalIdentityAuthority().takeUnretainedValue() let query = CSIdentityQueryCreate(nil, kCSIdentityClassUser, defaultAuthority).takeRetainedValue() guard CSIdentityQueryExecute(query, 0, nil), let identities = CSIdentityQueryCopyResults(query).takeRetainedValue() as? [CSIdentity] else { return [] } for ident in identities { MyLogger.info.log("CSIdentity: \(ident.hashValue, privacy: .public)") } let idents = identities .compactMap { Identity( posixUID: CSIdentityGetPosixID($0), posixName: CSIdentityGetPosixName($0).takeUnretainedValue() as String ) } .sorted { $0.posixName.localizedStandardCompare($1.posixName) == .orderedAscending } for ident in idents { MyLogger.info.log("Identity: \(ident.posixName, privacy: .public), \(ident.posixUID, privacy: .public)") } return idents } } Expected behavior: The code returns the user account created via VZMacGuestProvisioningOptions. Actual behavior: I get no user account When you test the same on a macOS 27 VM where the user is created via the traditional way (Setup assistant), the app shows the account. This also applies to all additional user accounts created after VM setup via System Settings.app. The bug also still exists on a VM created with macOS 27 beta 4. Is anybody having the same issue? Is that a bug in macOS 27? I already created a Feedback for this: FB23716201
2
0
108
3d
Memory Crash Test Table on 3GB RAM iOS Devices
The total physical memory of 3GB iOS devices is very tight. After system memory occupation, the available memory for third-party apps is extremely insufficient, leading to frequent OOM termination. Enabling or disabling JavaScriptCore causes a huge difference in app memory crash threshold. Without JSC, the app will crash at only 1.52GB memory usage, which severely restricts normal business running. The common 4MB and 8MB memory allocation used in our project falls into the high memory fragmentation range defined by libmalloc, resulting in the lowest memory crash limit and worst stability. Our core business relies heavily on JSC environment for JS interaction, resource rendering and dynamic logic execution. We cannot shut down JSC, but 3GB devices still face serious memory shortage even with JSC enabled. Mass users with 3GB RAM old iOS devices suffer from frequent app crashes, freeze, background kill and loading failure, which badly damage user experience and product reputation. We have finished all app-level memory optimization: adjust allocation size, optimize memory release, reduce resident memory, but still cannot break through the fixed memory crash limit. There is no effective solution on application layer. We sincerely ask Apple official engineers to provide official suggestions, system-level memory tuning solutions and JSC memory scheduling optimization guidance to solve the memory limit bottleneck on 3GB RAM iOS devices.
4
0
525
3d
Pinpointing dandling pointers in 3rd party KEXTs
I'm debugging the following kernel panic to do with my custom filesystem KEXT: panic(cpu 0 caller 0xfffffe004cae3e24): [kalloc.type.var4.128]: element modified after free (off:96, val:0x00000000ffffffff, sz:128, ptr:0xfffffe2e7c639600) My reading of this is that somewhere in my KEXT I'm holding a reference 0xfffffe2e7c639600 to a 128 byte zone that wrote 0x00000000ffffffff at offset 96 after that particular chunk of memory had been released and zeroed out by the kernel. The panic itself is emitted when my KEXT requests the memory chunk that's been tempered with via the following set of calls. zalloc_uaf_panic() __abortlike static void zalloc_uaf_panic(zone_t z, uintptr_t elem, size_t size) { ... (panic)("[%s%s]: element modified after free " "(off:%d, val:0x%016lx, sz:%d, ptr:%p)%s", zone_heap_name(z), zone_name(z), first_offs, first_bits, esize, (void *)elem, buf); ... } zalloc_validate_element() static void zalloc_validate_element( zone_t zone, vm_offset_t elem, vm_size_t size, zalloc_flags_t flags) { ... if (memcmp_zero_ptr_aligned((void *)elem, size)) { zalloc_uaf_panic(zone, elem, size); } ... } The panic is triggered if memcmp_zero_ptr_aligned(), which is implemented in assembly, detects that an n-sized chunk of memory has been written after being free'd. /* memcmp_zero_ptr_aligned() checks string s of n bytes contains all zeros. * Address and size of the string s must be pointer-aligned. * Return 0 if true, 1 otherwise. Also return 0 if n is 0. */ extern int memcmp_zero_ptr_aligned(const void *s, size_t n); Normally, KASAN would be resorted to to aid with that. The KDK README states that KASAN kernels won't load on Apple Silicon. Attempting to follow the instructions given in the README for Intel-based machines does result in a failure for me on Apple Silicon. I stumbled on the Pishi project. But the custom boot kernel collection that gets created doesn't have any of the KEXTs that were specified to kmutil(8) via the --explicit-only flag, so it can't be instrumented in Ghidra. Which is confirmed as well by running: % kmutil inspect -B boot.kc.kasan boot kernel collection at /Users/user/boot.kc.kasan (AEB8F757-E770-8195-458D-B87CADCAB062): Extension Information: I'd appreciate any pointers on how to tackle UAFs in kernel space.
10
0
1.3k
4d
HCE Entitlement eligibility - Device-to-Device use case for FIDO/passkey authentication
Hello, We operate PasskeyGuard, an iOS passkey/FIDO2 authentication app, and are evaluating adding NFC support. We'd like to confirm eligibility before starting development or submitting a formal entitlement request. Intended flow: Our iPhone app acts as the host (Host Card Emulation). Another device reads the iPhone over NFC to perform a FIDO2/WebAuthn authentication (the phone acts as a security-key-style authenticator, transmitting authentication data over NFC to the reading device). Based on the HCE support article, the closest matching category appears to be "Device-to-Device transactions." Our questions: Is a FIDO2/passkey authentication use case eligible under the Device-to-Device HCE entitlement, or does it fall outside the currently supported use cases? If eligible: are we permitted to register a custom applet AID (specifically the FIDO2 NFC AID A0000006472F0001) via CardSession, or is the set of allowed AIDs restricted per use case? Are there requirements beyond an EEA-established Organization account and the general "legal right / regulatory permissions" attestation that apply specifically to an authentication use case? We want to avoid investing development effort against an entitlement that may not be granted for this use case. Any guidance on eligibility and next steps would be greatly appreciated. Thank you, Alexander Friedl
1
0
127
5d
Behavior of cblas_zgemv when array contains nan.
In NumPy (actually originally in SciPy), we found a case where multiplying a complex matrix that contains inf+nanj by a complex vector could result in nan in the output vector in positions where the corresponding rows of the inputs did not contain nan. I have a C++ program and data to demonstrate this at https://github.com/WarrenWeckesser/experiments/tree/main/c%2B%2B/accelerate-zgemv-bug. When the full matrix CC is multiplied with the vector weights, the output at element 17 is nan. When just row 17 of CC is multiplied with weights, the result is not nan. The matrix CC does have some occurrences of inf+nanj, but not in the row that produces element 17 of the output. Is this a bug? Is there some way that the value inf+nanj in the input matrix can "contaminate" the output in a position that should give a non-nan value?
0
0
94
6d
Inquiry about Compatibility Issues in iOS 26​
Dear Apple Team,​ We are reaching out regarding several compatibility issues our app users have encountered after upgrading to iOS 26. These issues not only affect our application but also seem to impact the system's native settings, which has raised concerns about the universality of these problems.​ Problem Description​ Bluetooth Functionality: When users attempt to use the Bluetooth feature within our app after upgrading to iOS 26, the app freezes completely. What's more, when accessing the Bluetooth section in the system Settings app, it also freezes and ultimately crashes.​ Location Service: The location service on the device becomes inoperable after the iOS 26 upgrade. However, both the Bluetooth and location service issues are resolved after the user restarts the device.​ 2. Questions​ Universality: We are eager to know if these issues are exclusive to our app or are a more widespread problem among other applications on iOS 26. Are these known compatibility glitches in iOS 26? ​ Avoidance: Is there any guidance or best - practice that we, as developers, can follow to avoid these issues in our app? For example, are there specific API calls or configurations that need to be adjusted? ​ System - level Impact: If these are system - level bugs related to Bluetooth and location services, will they affect all apps that rely on these features? Or are there certain app - level mitigations that can be implemented? ​ We would greatly appreciate it if you could provide us with any insights, solutions, or information regarding these issues. Your prompt response will be crucial for us to address these problems and ensure a smooth user experience for our customers.​ Thank you in advance for your assistance.​ Best regards,
2
1
422
1w
macOS Archive builds and environment variables
Hi All - I'm a bit confused about setting environment variables in Mac Terminal when testing archive builds. In Terminal, if I do something like export DYLD_PRINT_LIBRARIES=1, it works great for Debug builds. When I open my Debug binary, I can see all the dylibs and Frameworks getting loaded. However, my Archive build doesn't show me anything when I try opening it from Terminal. I did some Googling and I guess SIP may be doing something to prevent environment vars from affecting Archive builds. This made sense to me until I tried creating a simple Test app. If I Archive my Test app and open the binary in Terminal, I see all the dylibs and frameworks. So why would an Archive build for a simple test project work with DYLD_PRINT_LIBRARIES, but my production app's Archive build won't? Related question: I've run into a situation where I may have to set LSEnvironment in my app's Info.plist to work around a problem in 10.15 Catalina and 11 Big Sur. Setting LSEnvironment works great in my Debug and Release builds. But just like using setting DYLD_PRINT_LIBRARIES in Terminal, my Archive build ignores the LSEnvironment settings. So... is there a way to create an Archive build that doesn't ignore Environment Variables in Terminal, or LSEnviroment in Info.plist? Hoping that there's a simple Build Setting that I can enable or disable in my Target to do this. Thanks.
3
0
195
1w
Core OS Resources
General: DevForums subtopic: App & System Services > Core OS Core OS is a catch-all subtopic for low-level APIs that don’t fall into one of these more specific areas: Processes & Concurrency Resources Files and Storage Resources Networking Resources Network Extension Resources Security Resources Virtualization Resources Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"
Replies
0
Boosts
0
Views
1.6k
Activity
Aug ’25
CMIO system extension: sysextd "no policy" + code 4 on 26.5 — resolved in 27?
Is macOS 27 Public Beta 2 able to activate new non‑MDM CMIO system extensions that fail on macOS 26.5.2? I'm building a virtual-camera app with a CMIO camera system extension (Developer ID signed + notarized), for personal use on my own Macs — no MDM. On macOS 26.5.2 (25F80) I can't get a new activation to succeed, and I'm trying to find out whether macOS 27 resolves it. Two failure modes I've seen: With SIP enabled, OSSystemExtensionRequest reaches the daemon, then sysextd logs: "no policy, cannot allow apps outside /Applications" — even though the app is in /Applications (verified real path, single copy, running from there). This matches other reports (e.g. LuLu / network extensions). With SIP disabled + systemextensionsctl developer on, it now fails earlier, client-side, with OSSystemExtensionErrorDomain code 4 — "Extension not found in App bundle / Unable to find any matched extension with identifier" — the request never even reaches sysextd. Things I've already verified/ruled out: Product type com.apple.product-type.system-extension; extension embedded at Contents/Library/SystemExtensions/; matching CFBundleIdentifier and Team ID; CMIOExtensionMachServiceName = $(TeamIdentifierPrefix)$(bundle id). App has com.apple.developer.system-extension.install (with authorizing profile); shared App Group + camera entitlement on both app and extension. Valid codesign --deep --strict; notarized + stapled; single LaunchServices registration; running the correct bundle. Reproduces with both Developer ID and Apple Development signing, and running straight from Xcode with a signed-in account. So the app/extension appear structurally correct; this looks like an OS-side regression in 26.5.x. My question: Has anyone successfully activated a new Developer ID (non-MDM) CMIO / system extension on macOS 27 Golden Gate Public Beta 2? Is this sysextd / code‑4 activation regression fixed there, or is it still present? Trying to decide whether upgrading is worth it. Thank you!
Replies
0
Boosts
0
Views
3
Activity
1h
Apple Pencil Pairing Issues
Is anybody else having a probelm pairing an Apple Pencil. I insert it into my new 2gen iPad Pro 12.9 and it briefly shows the dialog to Pair and then shows it connected, but then disconnects, and then I get an Error that the Pencil took to long to pair. Then it doesn't work.Am I alone in having this issue.Thanks,Nick
Replies
31
Boosts
0
Views
51k
Activity
6h
FSKit - Retrieve Process ID?
Does FSKit support the ability to get the process information, such as the pid, when a process accesses a resource? Being able have the process context is important for implementing certain access patterns and security logging in some contexts. For instance, we have a system that utilizes (pre-FSKit) a FUSE mount that, depending on the process has different "views" and "access" based on the process id.
Replies
3
Boosts
0
Views
569
Activity
23h
CTCellularPlanStatus.checkValidity(ofToken:) throws Couldn't communicate with a helper application on iOS 26
Hello, We are using the UPI device validation APIs on iOS 26+ in a production banking/UPI app, and we are seeing a recurring failure from CoreTelephony that we need guidance on. API / entitlement Framework: CoreTelephony API: CTCellularPlanStatus.checkValidity(ofToken:) Related: CTCellularPlanStatus.token() Entitlement: com.apple.developer.upi-device-validation Availability: iOS 26.0+ Minimal call site do { let isValid = try await CTCellularPlanStatus.checkValidity(ofToken: token) // isValid == true/false -> expected outcomes } catch { // Unexpected: API throws instead of returning Bool print(error.localizedDescription) } Error error.localizedDescription is: English: Couldn't communicate with a helper application. Same failure also appears with a localized Hindi message on Hindi-locale devices. This is distinct from checkValidity(ofToken:) returning false (token/SIM mismatch). Here the API throws, so we cannot tell whether the token is valid. In production we currently only have this localizedDescription from telemetry. Production observations (large fleet, last few days) Observed only on production user devices so far; we have not reproduced it reliably on lab hardware. Occurs across multiple iOS 26.x builds (notably 26.5.2, 26.5, 26.6; also seen on 26.0-27.0). Not limited to a single patch. Seen on many iPhone models (not one SKU). Latency is bimodal for the same error string: large share fails in under 100 ms (immediate) another large share fails after about 2-10+ seconds (timeout-like) Observed under Wi-Fi, cellular (4G/5G), and No Connection / radio-not-ready conditions. Same device can emit many identical failures within about 1 second when validity is checked from multiple call sites concurrently. Token generation (CTCellularPlanStatus.token()) and successful checkValidity work for the vast majority of users; this throw is a smaller but material failure class. Questions for Apple Is "Couldn't communicate with a helper application." an expected / documented failure mode of checkValidity(ofToken:) (for example CommCenter/XPC unavailable, radio not ready)? What conditions typically trigger this error from checkValidity(ofToken:)? Recommended client handling: retry (with backoff)? treat as transient and skip forcing re-binding? surface to user? Does validation require cellular registration / SIM ready state even when docs indicate internet is not required? Any known issues on specific iOS 26.x builds, dual-SIM, eSIM, or airplane-mode transitions? Is concurrent checkValidity from multiple tasks unsupported / unsafe? Because this is currently production-only and not reliably reproducible on lab devices, we cannot attach a sysdiagnose or Instruments trace at this time. We can share aggregated production telemetry and API details via Feedback Assistant if helpful. Thank you.
Replies
0
Boosts
0
Views
38
Activity
1d
iOS 27
My location is very lagging now unlike before
Replies
0
Boosts
0
Views
34
Activity
1d
macOS 27 beta — TCC intermittently blocks file writes during postinstall (I/O errors when unpacking .app)
Our app uses a Distribution.xml-based installer. Within the postinstall script, we attempt to untar a signed and notarized .app to the /Applications directory. On macOS 27 (tested up to Developer Beta 4), the tar command randomly fails to write random unpacked files with an I/O error; in the console there is "spolicyd[721] revoked access to "/Applications/XXX.app/file/within". It can be reproduced approximately every 4th install. Is this happening for anyone else? Any known workaround?
Replies
2
Boosts
1
Views
100
Activity
1d
Removing or invalidating a BLE bond when the app is the peripheral (CBPeripheralManager)
Our iOS app runs in the peripheral role. A hardware accessory acts as the central: it connects to the app and bonds in order to read and write characteristics we declare with encryption-required permissions. The app advertises so a previously bonded accessory can reconnect on its own. The problem is that the bond lives on both sides and we can only clear one of them. The accessory has its own "forget this phone" function, and it can also be told to do so remotely. iOS keeps its half, and we have not found any way for the app to remove or invalidate it. What we've checked: CBPeripheralManager and CBCentral expose no unpair or unbond operation. A CBCentral is only visible while connected or subscribed, and its identifier is a resolved handle. Questions: Is there a supported way for an app in the peripheral role to remove or invalidate the pairing keys for a bonded central? If we've missed an API, please point us at it. If not, what's the recommended approach when the peer has discarded its keys and the bond is no longer usable? Can a peripheral-role app detect that state — a distinguishable error or connection event when encryption fails — so we can tell the user something accurate instead of a generic connection failure?
Replies
3
Boosts
0
Views
96
Activity
1d
FSEvents vs Endpoint Security Framework for a macOS file-operation audit product
I'm developing a macOS product that generates verifiable audit records of media-asset movement on endpoints, for professional media-production companies. It is not an antivirus or Data Loss Prevention product; it collects operating-system file-system events and converts them into tamper-evident audit evidence and audit reports. Target users need comprehensive endpoint audit trails for compliance with industry security standards, including Motion Picture Association Trusted Partner Network assessments. The product must reliably distinguish these operations: file copy, move, rename, and volume mount and unmount — including on external volumes. I've reviewed existing forum guidance, including Quinn's explanation that FSEvents only signals that "something changed" rather than the exact operation, and that it is designed around Spotlight and Time Machine semantics. In my own testing I've also seen inconsistent flags across cp, Finder copy, and application saves, and frequent kFSEventStreamEventFlagMustScanSubDirs events on external drives even when nothing along the path changed. Questions: Given the above, for an audit product that must reliably distinguish copy vs. move vs. rename, should FSEvents be treated as structurally unsuitable, with the Endpoint Security Framework adopted instead as the primary source? For capturing volume mount and unmount operations, is the Endpoint Security Framework the recommended source, or should this be combined with Disk Arbitration? Are there long-term supported APIs recommended for this type of endpoint audit product, to ensure compatibility with future macOS releases? Any recommended documentation, WWDC sessions, or sample code for this use case would be appreciated. For context, I'm building toward a System Extension using the Endpoint Security Framework and will file the entitlement request separately; this post is to confirm the architectural direction before committing. Thank you.
Replies
7
Boosts
0
Views
253
Activity
2d
Can't sign into Apple account on a Golden Gate b1 VM
I am unable to sign into my Apple account on a Golden Gate b1 VM. Thus, I'm unable to switch to the beta channel and upgrade this VM to the latest beta Golden Gate seed. The error I get is: Verification Failed An unknown error occurred. I've looked in Console.app for any clues and no luck so far. Is this a known issue and is there a workaround?
Replies
13
Boosts
0
Views
869
Activity
2d
Managed Apple ID works for iMessage on bare metal, but fails in macOS VM (same hardware)
Hi all, I'm running 2 macOS VMs on a bare-metal Mac (host is also macOS). I'm seeing inconsistent iMessage sign-in behavior depending on the Apple ID type and whether it's bare metal or virtualized: Managed Apple ID (ABM-issued): signs into iMessage fine on the bare-metal host. Same Managed Apple ID: fails to sign into iMessage inside the VM on the same physical machine. Personal/basic Apple ID: signs in fine in the VM without issue. Has anyone run into this specific combination — MAID working on bare metal but not inside a VM, while a personal ID works fine in both?
Replies
0
Boosts
0
Views
74
Activity
2d
com.apple.asam profile installs but is reported as "com.apple.unknown" on iOS 26.5.1 (ASAM not granted)
I'm trying to enable Autonomous Single App Mode (ASAM) for my own app on a supervised iPhone, but UIAccessibility.requestGuidedAccessSession(enabled:) always returns false, even though the com.apple.asam profile installs without error. Environment Device: iPhone 16 (iPhone18,5), iOS 26.5.1 Supervised: yes (verified via DeviceInformation query → IsSupervised = true) MDM: self-hosted NanoMDM. Other payloads (com.apple.webcontent-filter, com.apple.applicationaccess) install and work correctly. App: development-signed, Bundle ID net.self-control-mdm.SessionLock, Team ID 9VH4G6KS29 Profile I'm sending (matches the AutonomousSingleAppMode documentation exactly): What happens InstallProfile is Acknowledged with no ErrorChain. A ProfileList query shows the profile IS installed, but its payload type is reported as com.apple.unknown (display name is preserved). In Settings → General → VPN & Device Management, the profile shows the payload as "Unknown Payload". In the app, requestGuidedAccessSession(enabled: true) completion returns success = false. Rebooting the device does not change anything. Questions Is the legacy com.apple.asam profile payload still honored on iOS 26, or has ASAM authorization moved to Declarative Device Management? If DDM is now required, which declaration/configuration should I use to allow-list an app for ASAM? Does com.apple.unknown in the ProfileList response indicate the payload was genuinely not recognized, or is that expected for this payload type? Are there additional requirements on iOS 26 (e.g., the app must be an MDM-managed app, or a non-development signature) for requestGuidedAccessSession to succeed? Thanks in advance.
Replies
7
Boosts
0
Views
401
Activity
2d
Failure to mount an FSKit volume *sometimes*
Hello, I'm working on a project for a file system using FSKit and I'm currently experiencing a strange issue on macOS 26 to which I updated recently. While testing, I'm doing incremental debug builds using Xcode. I'm very careful to make sure I only have a single instance of the built app (hosting the file system extension) anywhere on disk. I run the app, mount the file system, run some tests, unmount, kill the app, make changes, and repeat. Once in a while, however, mount would suddenly start failing with mount: Loading resource: The operation couldn’t be completed. (com.apple.extensionKit.errorDomain error 2.) mount: File system named MyFS not found This would consistently repeat until I clean the build folder, rebuild and run again. I would continue testing for a while, then at some point mount would start failing again. I looked at the system logs and found this message from extensionkitservice: Failed to initialize _EXExtensionIdentity: Error Domain=com.apple.extensionKit.errorDomain Code=5 "Failed to find extension: 24B7F729-5AD1-4486-92B4-1F57CACCA265" So I started going through the logs in more detail and found the following: lsd seems to unregister and register the file system extension occasionally, each time giving it a different UUID. I can see logs about "com.apple.LaunchServices.pluginsregistered" and "com.apple.LaunchServices.pluginsunregistered" notifications being sent with their data. What seems to be the problem is that sometimes after this happens, when I attempt to mount the file system, the extensionkitservice would fail to find the extension because it is referencing it using one of its previous UUIDs assigned by lsd, not its latest one, judging by the UUID in the log message. Am I doing something wrong here? I think I may be causing the constant unregister/register of the extension idirectly by rebuilding via Xcode. Or is it a problem with extensionkitservice? I've never had this happen on Sequoia. macOS 26.0.1 (25A362); Xcode 26.0.1 (17A400) Thank you
Replies
5
Boosts
1
Views
724
Activity
3d
High Power Mode not applied by powerd after Migration Assistant (migrateenergyprefs related?)
High Power Mode setting is not applied by powerd (possibly related to migrateenergyprefs) Summary On a MacBook Pro (14-inch, M5 Max), enabling High Power Mode in System Settings has no effect on the actual power governor. The system continues to run at the default (Automatic-equivalent) power ceiling regardless of the High Power Mode setting. The same symptom has been reproduced on a different physical machine, a MacBook Pro (M4 Max), ruling out a single hardware defect. Environment Affected device: MacBook Pro 14-inch (Apple M5 Max, 12P+6S+40GPU, 128GB RAM) macOS version: macOS 26.5.1 (Build 25F80) Migration history: Intel Mac → MacBook Air (M2) → MacBook Pro (M4 Max) → MacBook Pro (M5 Max), using Migration Assistant at each step Same symptom also confirmed on the MacBook Pro (M4 Max), which had the same migration history Symptom Selecting "High Power" under System Settings → Battery → Power Mode has no effect on system_profiler SPPowerDataType, which always reports High Power Mode: No. pmset -g custom correctly shows powermode 2 (the High Power equivalent) for AC Power, confirming the user-facing setting is being written correctly. Low Power Mode in the same system_profiler output correctly toggles between Yes/No depending on the UI selection (Automatic / Low Power / High Power). Only High Power Mode fails to track the UI selection. Benchmarking with 3DMark Steel Nomad Stress Test (Metal API) reproduces the score pattern that third-party reviews report for High Power Mode OFF (stabilized score ~3100–3400), rather than the ON pattern reported for the same model (~3600+). This confirms the issue is not just cosmetic (a wrong status string) but reflects an actual difference in the power ceiling being enforced. Investigation steps taken 1. Preference file inspection Inspected /Library/Preferences/com.apple.PowerManagement.<UUID>.plist. Multiple UUID-keyed files exist, each corresponding to a previously used device (identified by battery serial number in the BatteryWarn key). All of them contained HighPowerMode = 0, including the file matching the current machine's serial number. The MacBook Air (M2) used earlier in this device's migration history does not support High Power Mode at all. It's suspected that HighPowerMode = 0 originated from that device and was carried forward through subsequent Migration Assistant transfers to devices that do support the feature, without ever being correctly re-evaluated. 2. Direct write test Used defaults write to directly set HighPowerMode = 1 in the relevant plist. system_profiler then reported High Power Mode: Yes, and this persisted across a reboot. However, a subsequent benchmark run showed no improvement — powermetrics Combined Power remained in the 27–30W range, and the Steel Nomad Stress Test stabilized score actually dropped slightly (~3134 average over the last 10 loops). This indicates the displayed value is decoupled from the actual power governor state. 3. File deletion / regeneration test Deleted the UUID-keyed plist (after backing it up) and let powerd regenerate it from scratch. The newly generated file still showed HighPowerMode stuck at No and unresponsive to UI changes, while LowPowerMode continued to track UI changes correctly. The same test was repeated with the non-UUID common file (com.apple.PowerManagement.plist), with no change in behavior. This rules out stale/corrupted preference data as the root cause. 4. Binary-level investigation Searched the system for files containing the string "HighPowerMode". Aside from unified logging symbol caches (uuidtext, not relevant), the following were found: /System/Library/CoreServices/powerd.bundle/powerd (Apple-signed, Signed Time: Apr 19, 2026, Platform identifier 26) /System/Library/CoreServices/powerd.bundle/migrateenergyprefs.bundle/ (com.apple.migrateenergyprefs, LSMinimumSystemVersion 26.5, built with Xcode 2630) /System/Library/SystemProfiler/SPPowerReporter.spreporter/ /System/Library/ExtensionKit/Extensions/BatterySettingsIntentsExtension.appex/ The presence of a dedicated com.apple.migrateenergyprefs component strongly suggests this is the code path responsible for carrying power preferences across device migrations. We suspect this migration logic fails to correctly initialize or re-evaluate HighPowerMode when migrating from a device that doesn't support the feature to one that does. Reproducibility Reproduced on two distinct physical machines (M4 Max and M5 Max), making a hardware fault unlikely. Reproduced after deleting and regenerating the preference files, ruling out simple cache corruption. Reproduced after a full reboot, ruling out a transient in-memory state issue alone. Impact Because High Power Mode is not actually engaged, sustained CPU/GPU performance under heavy load is capped at a lower power ceiling than intended, resulting in measurably lower benchmark scores and sustained performance compared to the documented behavior of the same hardware configuration. Questions for Apple Could the com.apple.migrateenergyprefs logic be reviewed for how it handles HighPowerMode when migrating from a device that does not support the feature (e.g., MacBook Air M2) to one that does? Is there a known issue with HighPowerMode specifically (as opposed to LowPowerMode, which behaves correctly) not being written back by powerd in response to UI changes? Are there other users with a similar multi-generation Migration Assistant history reporting the same symptom? Happy to provide a sysdiagnose or additional logs if useful.
Replies
16
Boosts
1
Views
762
Activity
3d
User created via VZMacGuestProvisioningOptions is not returned by CSIdentityQueryExecute()
This post applies to Apple Virtualization framework feature to setup a user account during VM setup (VZMacGuestProvisioningOptions) introduced in macOS 27: Issue: Creating a user via VZMacGuestProvisioningOptions during VM setup, results in a user which is not returned by CSidentityQueryExecute(). Same code executed on a macOS 26 VM or a macOS 27 VM where the user was created by hand within the VM (so without VZMacGuestProvisioningOptions) returns the user. How to reproduce: Create an VM via the Apple Virtualization framework and use the VZMacGuestProvisioningOptions to create the user during VM setup. I actually used Virtual Buddy and Tart to do this. Then run the following code: internal enum MyLogger { static let info = Logger(subsystem: Bundle.main.bundleIdentifier!, category: "Utils-\(getuid())") } public struct Identity { public let posixUID: id_t public let posixName: String init?(posixUID: id_t, posixName: String) { self.posixUID = posixUID self.posixName = posixName } } class Utils { public static func userIdentities() -> [Identity] { let defaultAuthority = CSGetLocalIdentityAuthority().takeUnretainedValue() let query = CSIdentityQueryCreate(nil, kCSIdentityClassUser, defaultAuthority).takeRetainedValue() guard CSIdentityQueryExecute(query, 0, nil), let identities = CSIdentityQueryCopyResults(query).takeRetainedValue() as? [CSIdentity] else { return [] } for ident in identities { MyLogger.info.log("CSIdentity: \(ident.hashValue, privacy: .public)") } let idents = identities .compactMap { Identity( posixUID: CSIdentityGetPosixID($0), posixName: CSIdentityGetPosixName($0).takeUnretainedValue() as String ) } .sorted { $0.posixName.localizedStandardCompare($1.posixName) == .orderedAscending } for ident in idents { MyLogger.info.log("Identity: \(ident.posixName, privacy: .public), \(ident.posixUID, privacy: .public)") } return idents } } Expected behavior: The code returns the user account created via VZMacGuestProvisioningOptions. Actual behavior: I get no user account When you test the same on a macOS 27 VM where the user is created via the traditional way (Setup assistant), the app shows the account. This also applies to all additional user accounts created after VM setup via System Settings.app. The bug also still exists on a VM created with macOS 27 beta 4. Is anybody having the same issue? Is that a bug in macOS 27? I already created a Feedback for this: FB23716201
Replies
2
Boosts
0
Views
108
Activity
3d
Memory Crash Test Table on 3GB RAM iOS Devices
The total physical memory of 3GB iOS devices is very tight. After system memory occupation, the available memory for third-party apps is extremely insufficient, leading to frequent OOM termination. Enabling or disabling JavaScriptCore causes a huge difference in app memory crash threshold. Without JSC, the app will crash at only 1.52GB memory usage, which severely restricts normal business running. The common 4MB and 8MB memory allocation used in our project falls into the high memory fragmentation range defined by libmalloc, resulting in the lowest memory crash limit and worst stability. Our core business relies heavily on JSC environment for JS interaction, resource rendering and dynamic logic execution. We cannot shut down JSC, but 3GB devices still face serious memory shortage even with JSC enabled. Mass users with 3GB RAM old iOS devices suffer from frequent app crashes, freeze, background kill and loading failure, which badly damage user experience and product reputation. We have finished all app-level memory optimization: adjust allocation size, optimize memory release, reduce resident memory, but still cannot break through the fixed memory crash limit. There is no effective solution on application layer. We sincerely ask Apple official engineers to provide official suggestions, system-level memory tuning solutions and JSC memory scheduling optimization guidance to solve the memory limit bottleneck on 3GB RAM iOS devices.
Replies
4
Boosts
0
Views
525
Activity
3d
Pinpointing dandling pointers in 3rd party KEXTs
I'm debugging the following kernel panic to do with my custom filesystem KEXT: panic(cpu 0 caller 0xfffffe004cae3e24): [kalloc.type.var4.128]: element modified after free (off:96, val:0x00000000ffffffff, sz:128, ptr:0xfffffe2e7c639600) My reading of this is that somewhere in my KEXT I'm holding a reference 0xfffffe2e7c639600 to a 128 byte zone that wrote 0x00000000ffffffff at offset 96 after that particular chunk of memory had been released and zeroed out by the kernel. The panic itself is emitted when my KEXT requests the memory chunk that's been tempered with via the following set of calls. zalloc_uaf_panic() __abortlike static void zalloc_uaf_panic(zone_t z, uintptr_t elem, size_t size) { ... (panic)("[%s%s]: element modified after free " "(off:%d, val:0x%016lx, sz:%d, ptr:%p)%s", zone_heap_name(z), zone_name(z), first_offs, first_bits, esize, (void *)elem, buf); ... } zalloc_validate_element() static void zalloc_validate_element( zone_t zone, vm_offset_t elem, vm_size_t size, zalloc_flags_t flags) { ... if (memcmp_zero_ptr_aligned((void *)elem, size)) { zalloc_uaf_panic(zone, elem, size); } ... } The panic is triggered if memcmp_zero_ptr_aligned(), which is implemented in assembly, detects that an n-sized chunk of memory has been written after being free'd. /* memcmp_zero_ptr_aligned() checks string s of n bytes contains all zeros. * Address and size of the string s must be pointer-aligned. * Return 0 if true, 1 otherwise. Also return 0 if n is 0. */ extern int memcmp_zero_ptr_aligned(const void *s, size_t n); Normally, KASAN would be resorted to to aid with that. The KDK README states that KASAN kernels won't load on Apple Silicon. Attempting to follow the instructions given in the README for Intel-based machines does result in a failure for me on Apple Silicon. I stumbled on the Pishi project. But the custom boot kernel collection that gets created doesn't have any of the KEXTs that were specified to kmutil(8) via the --explicit-only flag, so it can't be instrumented in Ghidra. Which is confirmed as well by running: % kmutil inspect -B boot.kc.kasan boot kernel collection at /Users/user/boot.kc.kasan (AEB8F757-E770-8195-458D-B87CADCAB062): Extension Information: I'd appreciate any pointers on how to tackle UAFs in kernel space.
Replies
10
Boosts
0
Views
1.3k
Activity
4d
HCE Entitlement eligibility - Device-to-Device use case for FIDO/passkey authentication
Hello, We operate PasskeyGuard, an iOS passkey/FIDO2 authentication app, and are evaluating adding NFC support. We'd like to confirm eligibility before starting development or submitting a formal entitlement request. Intended flow: Our iPhone app acts as the host (Host Card Emulation). Another device reads the iPhone over NFC to perform a FIDO2/WebAuthn authentication (the phone acts as a security-key-style authenticator, transmitting authentication data over NFC to the reading device). Based on the HCE support article, the closest matching category appears to be "Device-to-Device transactions." Our questions: Is a FIDO2/passkey authentication use case eligible under the Device-to-Device HCE entitlement, or does it fall outside the currently supported use cases? If eligible: are we permitted to register a custom applet AID (specifically the FIDO2 NFC AID A0000006472F0001) via CardSession, or is the set of allowed AIDs restricted per use case? Are there requirements beyond an EEA-established Organization account and the general "legal right / regulatory permissions" attestation that apply specifically to an authentication use case? We want to avoid investing development effort against an entitlement that may not be granted for this use case. Any guidance on eligibility and next steps would be greatly appreciated. Thank you, Alexander Friedl
Replies
1
Boosts
0
Views
127
Activity
5d
Behavior of cblas_zgemv when array contains nan.
In NumPy (actually originally in SciPy), we found a case where multiplying a complex matrix that contains inf+nanj by a complex vector could result in nan in the output vector in positions where the corresponding rows of the inputs did not contain nan. I have a C++ program and data to demonstrate this at https://github.com/WarrenWeckesser/experiments/tree/main/c%2B%2B/accelerate-zgemv-bug. When the full matrix CC is multiplied with the vector weights, the output at element 17 is nan. When just row 17 of CC is multiplied with weights, the result is not nan. The matrix CC does have some occurrences of inf+nanj, but not in the row that produces element 17 of the output. Is this a bug? Is there some way that the value inf+nanj in the input matrix can "contaminate" the output in a position that should give a non-nan value?
Replies
0
Boosts
0
Views
94
Activity
6d
Inquiry about Compatibility Issues in iOS 26​
Dear Apple Team,​ We are reaching out regarding several compatibility issues our app users have encountered after upgrading to iOS 26. These issues not only affect our application but also seem to impact the system's native settings, which has raised concerns about the universality of these problems.​ Problem Description​ Bluetooth Functionality: When users attempt to use the Bluetooth feature within our app after upgrading to iOS 26, the app freezes completely. What's more, when accessing the Bluetooth section in the system Settings app, it also freezes and ultimately crashes.​ Location Service: The location service on the device becomes inoperable after the iOS 26 upgrade. However, both the Bluetooth and location service issues are resolved after the user restarts the device.​ 2. Questions​ Universality: We are eager to know if these issues are exclusive to our app or are a more widespread problem among other applications on iOS 26. Are these known compatibility glitches in iOS 26? ​ Avoidance: Is there any guidance or best - practice that we, as developers, can follow to avoid these issues in our app? For example, are there specific API calls or configurations that need to be adjusted? ​ System - level Impact: If these are system - level bugs related to Bluetooth and location services, will they affect all apps that rely on these features? Or are there certain app - level mitigations that can be implemented? ​ We would greatly appreciate it if you could provide us with any insights, solutions, or information regarding these issues. Your prompt response will be crucial for us to address these problems and ensure a smooth user experience for our customers.​ Thank you in advance for your assistance.​ Best regards,
Replies
2
Boosts
1
Views
422
Activity
1w
macOS Archive builds and environment variables
Hi All - I'm a bit confused about setting environment variables in Mac Terminal when testing archive builds. In Terminal, if I do something like export DYLD_PRINT_LIBRARIES=1, it works great for Debug builds. When I open my Debug binary, I can see all the dylibs and Frameworks getting loaded. However, my Archive build doesn't show me anything when I try opening it from Terminal. I did some Googling and I guess SIP may be doing something to prevent environment vars from affecting Archive builds. This made sense to me until I tried creating a simple Test app. If I Archive my Test app and open the binary in Terminal, I see all the dylibs and frameworks. So why would an Archive build for a simple test project work with DYLD_PRINT_LIBRARIES, but my production app's Archive build won't? Related question: I've run into a situation where I may have to set LSEnvironment in my app's Info.plist to work around a problem in 10.15 Catalina and 11 Big Sur. Setting LSEnvironment works great in my Debug and Release builds. But just like using setting DYLD_PRINT_LIBRARIES in Terminal, my Archive build ignores the LSEnvironment settings. So... is there a way to create an Archive build that doesn't ignore Environment Variables in Terminal, or LSEnviroment in Info.plist? Hoping that there's a simple Build Setting that I can enable or disable in my Target to do this. Thanks.
Replies
3
Boosts
0
Views
195
Activity
1w