Explore the core architecture of the operating system, including the kernel, memory management, and process scheduling.

Posts under Core OS subtopic

Post

Replies

Boosts

Views

Activity

Core OS Resources
General: DevForums subtopic: App & System Services > Core OS Core OS is a catch-all subtopic for low-level APIs that don’t fall into one of these more specific areas: Processes & Concurrency Resources Files and Storage Resources Networking Resources Network Extension Resources Security Resources Virtualization Resources Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"
0
0
2k
Aug ’25
Supported way for an arm64 process to map below the 4 GB __PAGEZERO floor?
Hi Quinn — following up from DTS case 22070584. I'm working on a Windows compatibility runtime (Wine plus a CPU translator) that runs natively on Apple Silicon. 64-bit x86 Windows programs work fine. 32-bit ones don't, because they need address space in the low 4 GB: guest pointers are 32-bit, and some Windows structures sit at fixed addresses like 0x7ffe0000 that programs read directly. On arm64 I can't get anything down there: task_info(TASK_VM_INFO) -> min_address 0x100ea0000 mmap(0x7ffe0000, MAP_FIXED) -> ENOMEM mach_vm_allocate(0x7ffe0000, VM_FLAGS_FIXED) -> KERN_INVALID_ADDRESS There's also nothing below 4 GB to remove: mach_vm_region finds no entry there at all, and mach_vm_deallocate(0, 4 GB) returns KERN_SUCCESS without changing anything. Building with a smaller __PAGEZERO doesn't help either — every size I tried (0x1000, 0x4000, 0x10000, 0x100000, 0x1000000, 0x10000000, 0x80000000) gets SIGKILLed before main, with no crash report. Ad-hoc signing, the hardened runtime and -no_pie made no difference. I did notice /usr/libexec/rosetta/runtime is arm64 with no __PAGEZERO segment at all and __TEXT at vmaddr 0, so the kernel can clearly do this, at least for platform binaries. Is there a supported way for a third-party arm64 process to map below 4 GB — an entitlement, a spawn attribute, something I've missed? If the answer is no, that's fine, I'd just like to know so I can stop looking and plan around it. I have two small test programs that print all of the above if they'd be useful.
6
0
747
19h
Kernel panic "m->m_flags & M_PKTHDR" in uipc_mbuf.c on SMB clients over 10 GbE (macOS 26)
We have a group of Macs that mount SMB shares over 10 GbE with jumbo frames (MTU 9000). Since late June, they have been kernel panicking several times a day with the same assertion: panic(cpu N caller ...): assertion failed: m->m_flags & M_PKTHDR, file: .../xnu/bsd/kern/uipc_mbuf.c, line: 4839 @uipc_socket.c:8260 Panicked thread: dlil_input_en0 Last started kext: com.apple.filesystems.smbfs 6.0.1 Environment Clients: Mac Studio (M1 Max and M1 Ultra) and Mac Pro (2019, Intel with T2), using the built-in 10GBASE-T at MTU 9000 macOS 26.5.1 (25F80), 26.6.2 (25G83) and 26.7 (25G229); it panics on all three Servers: Samba-based NAS, SMB 3.1.1, signing on, encryption off Filed as FB24912731 What we've found It still panics with our third-party EDR fully uninstalled. The Mac that panics needs an active SMB session. A Mac left on the network without a share mounted stayed up through several events that took down the others. Panics are often simultaneous across machines: two to six Macs, with different hardware and different macOS builds, within the same minute. It doesn't need sustained heavy throughput. Some panics came within minutes of reconnecting, during light editing. Setting kern.skywalk.flowswitch.rx_agg_tcp_host=0 did not help. The switch and server links stay up, and spanning tree doesn't change during these events. Only the Macs' ports drop. In one server-side capture, the client stopped sending within about 0.2 ms of receiving a READ response made of 8948-byte frames. That fits the panicked thread being dlil_input. Two existing threads look related Kernel panic using Vagrant synced folders via NFS beginning with macOS 15.4 (FB17853906). A DTS reply there said the issue is in kernel mbuf management and that SMB "is very likely to experience a similar panic." Incorrect packet handling in SMBClient MacOS 26, which describes a race in SMBClient under heavy load above about 10 Gbps. Questions Is this the same underlying issue as FB17853906, and is a fix planned for macOS 26? Our 2019 Mac Pros can't move to a later major release. Is there a known workaround, such as a sysctl, an nsmb.conf option, or a change to MTU or offload settings? Is there logging or a diagnostic we can leave enabled to capture more state at panic time? We can't reproduce this on demand, but between several machines we see it multiple times a day. We can provide full panic reports, sysdiagnoses, and packet captures from both client and server sides.
1
0
349
19h
macOS 26.7: opening Control Center Sound causes BLE HID mouse lag, HID service loss, and result 307
I am seeing a repeatable interaction between audio activity or audio-device discovery and a Bluetooth LE HID mouse on a Mac mini M2 Pro. Opening the detailed Sound panel in Control Center, or changing the HDMI audio output, makes the pointer stutter. Opening Apple’s Music.app has also caused a temporary complete loss of the mouse. In the worst cases, the mouse becomes completely unavailable and does not recover without Bluetooth troubleshooting or re-pairing. Configuration Mac mini Mac14,12, Apple M2 Pro, 32 GB RAM macOS Tahoe 26.7 (25G229) Also reproduced on macOS Tahoe 26.1 (25B78) Logitech MX Anywhere 3 Mac over Bluetooth LE VID 0x046D, PID 0xB025 Firmware MPM24.01_0015 Logitech MX Keys M Mac over Bluetooth LE PL4071UH display and audio output over HDMI Logi Options+ installed Trigger Connect the MX Anywhere 3 Mac and MX Keys over Bluetooth. Open Control Center from the menu bar. Open the detailed Sound panel, or change the HDMI audio output. Move the Bluetooth mouse continuously while audio-output discovery is taking place. The issue is intermittent, but it has been reproduced several times on both macOS 26.1 and 26.7. Pointer stuttering can continue after the Sound panel is closed. A later incident occurred when I opened Apple’s Music.app. The Bluetooth mouse became unavailable again, but this time it recovered automatically after approximately ten seconds. The Sony WH-1000XM6 headset was connected over Bluetooth, while the 512 GB USB flash drive was not connected. This shows that the USB drive is not required for a temporary mouse loss and makes concurrent Bluetooth audio activity a more relevant condition to investigate. The additional trigger suggests that the problem may not be limited to the Control Center interface itself and may also be associated with audio-subsystem initialization or audio-device activity. This is an observation, not yet a confirmed causal link. Additional condition in the permanent-loss cases In every incident where the mouse did not recover on its own and became effectively unusable, the following two devices were also present: a Sony WH-1000XM6 wireless headset connected over Bluetooth; a 512 GB SanDisk USB flash drive connected to the Mac. I am reporting this as a correlation, not as a confirmed cause. The headset adds simultaneous Bluetooth audio activity. The USB drive may or may not be relevant depending on its USB mode, activity, shielding, physical location, and possible 2.4 GHz interference. The 512 GB capacity is included only to identify the device. Less severe cursor stuttering has also been observed around Sound-panel discovery; the two devices above are specifically the common condition I recorded during the permanent mouse-loss incidents. Observed result The pointer starts stuttering and raw mouse HID reports develop multi-second gaps. In severe incidents, the Bluetooth mouse stops working entirely. Opening Music.app has also caused a temporary complete loss of the mouse; during that incident the Sony WH-1000XM6 was connected over Bluetooth, the USB flash drive was not connected, and the mouse recovered automatically after approximately ten seconds. Logi Options+ then displays the mouse as inactive. The mouse disappears from the IOHID tree, while the Bluetooth keyboard can remain present. A wired USB mouse remains responsive, so the Mac and pointer rendering are not completely frozen. The failure can persist after the Sound panel is closed. Relevant logs On macOS 26.7, bluetoothd repeatedly recorded the following sequence for the MX Anywhere 3 Mac: MX Anywhere 3 Mac needs low latency current connection parameters: interval 30.00 ms, latency 0 connection changed to: interval 7.50 ms, latency 44 Device "MX Anywhere 3 Mac" is Incompatible LE HID Device "MX Anywhere 3 Mac" does not have _HID_SERVICE_ Connection timed out disconnect result: 307 BLEPaired HIDBadBehavior Central The sequence repeated during automatic reconnection attempts. The mouse later recovered on some occasions, but other incidents required turning Bluetooth off for about 15 seconds, turning it back on, forgetting the mouse, and pairing it again. Instrumented reproduction During a monitored reproduction on macOS 26.1: detailed audio discovery started at +21.333 s; a 2.400 s gap in raw HID reports from the mouse occurred 0.899 s before that event; bluetoothd then reported a HID lag issue for VID 0x046D, PID 0xB025 at +1.897 s; no display-frame gaps were detected; there was no sustained CPU saturation. This indicates that the interruption is already present in the raw HID input stream. It does not appear to be only a cursor animation or WindowServer rendering delay. Expected result Discovering or switching audio outputs should not alter a separate BLE HID mouse connection, cause multi-second HID report gaps, remove _HID_SERVICE_, or disconnect the mouse. Technical points for investigation Could this be a macOS Bluetooth/HID connection-parameter or service-discovery problem triggered by concurrent audio discovery? In particular, why does macOS change the mouse from 30 ms / latency 0 to 7.5 ms / latency 44, then classify it as Incompatible LE HID, lose _HID_SERVICE_, and eventually disconnect it with result 307? Has anyone reproduced the same sequence with a Logitech BLE mouse, a Bluetooth audio headset, or a USB 3 storage device connected? The issue was also submitted through Apple’s public macOS feedback form on 24 September 2026. That form confirmed receipt but did not provide an FB case number. Possibly related report Another Developer Forums report describes a different BLE HID device with Incompatible LE HID and disconnect result 307 on macOS 27. The hardware and trigger are different, but the Bluetooth/HID failure signature may be related: https://developer.apple.com/forums/thread/845857
6
0
143
23h
CoreBluetooth reconnection to legacy BLE directed advertisements differs across iPad hardware
To whomever this may concern, We are investigating a BLE firmware-update compatibility issue affecting a legacy Nordic nRF51 DFU bootloader on a subset of iPads. We are seeking guidance on whether there are known CoreBluetooth or Bluetooth-controller differences across recent iPad hardware that could affect reconnection to Bluetooth LE connectable directed advertisements. Background Our accessory uses a legacy Nordic nRF51 DFU flow: The iPad is connected to the accessory’s normal application firmware. The app requests entry into DFU mode. The accessory disconnects normally. The accessory restarts into its bootloader. The bootloader sends connectable directed advertisements targeted at the iPad that initiated DFU. The iPad is expected to reconnect, after which the firmware transfer begins. Observed behavior On working iPads, the BLE trace shows: Application disconnect → accessory begins connectable directed advertising → iPad sends BLE connection indication → bootloader connection succeeds → DFU begins On affected iPads, the trace shows: Application disconnect → accessory begins the same connectable directed advertising → no connection indication from the iPad → DFU cannot proceed The accessory is advertising to the current resolvable address of the connected iPad. The bootloader starts directed advertising at nearly identical timing in both working and failing traces, approximately 456 ms after disconnect. The initial disconnect is normal in both cases: LL_TERMINATE_IND / Remote User Terminated Connection / reason 0x13 The problem occurs only after the accessory begins directed advertising. It seems like the iPad might be able to receive and listen to directed advertisement, however it seems to be unable to send back a connection indication. Hardware correlation observed so far We observed a correlation with Bluetooth controller vendor information visible in our BLE captures: FORMAT FOR FOLLOWING LINES Result -> Example device -> Observed controller vendor DFU succeeds -> iPad Air, 5th generation -> Broadcom DFU succeeds -> Other tested iPads, including one iPad with an A16-class platform -> Broadcom DFU fails -> One affected iPad with an A16-class platform -> MediaTek We want to be careful not to overstate this result: We have tested only one affected MediaTek-based iPad so far. The model string is MD3Y4LL/A and its current iOS version 26.6.1. The functioning Broadcomm iPads A16 we have tested that did not fail DFU process have model string MD7F4KN/A. The other iPad models we tested DFU on (which were all successful, albeit none of them were MediaTek chips, they were all Broadcomm) were: MRJN2KN/A, MM9C3KN/A, MQ6J3KN/A, MM6T3KN/A (the latter with iOS 26.6.1 as well, suggesting it is not necessarily an iPad OS version issue) We have not found a second MediaTek-based iPad to determine whether the behavior reproduces across that hardware. We initially suspected that recent non-cellular iPads might consistently use MediaTek, but this was disproved by the iPad Air, 5th generation we tested (MM9C3KN/A): it had no cellular connection and used Broadcom, and DFU worked normally. Therefore, we do not conclude that the issue is caused by MediaTek hardware. We only see a correlation worth investigating. What we have ruled out The target firmware image is not involved; failure occurs before any firmware data is transferred. The accessory reaches bootloader mode and sends directed advertisements at the expected time. The iOS Nordic DFU library already calls CoreBluetooth’s normal reconnect API: centralManager.connect(peripheral, options: nil) iOS does not expose an API allowing an app to create or send a raw Link Layer CONNECT_IND; therefore the application cannot directly work around controller-level connection behavior. The affected iPad does not provide a normal scanner/discovery callback for this directed bootloader advertisement, so matching by name or service UUID is not available as an application-layer workaround. Questions . Are there known CoreBluetooth, iPadOS, or Bluetooth-controller differences that can affect handling of BLE connectable directed advertisements, particularly when an accessory directs advertisements to a central using a resolvable private address? . Is there a recommended CoreBluetooth pattern for reconnecting to a known peripheral after it restarts into a legacy bootloader that uses directed advertising? . Does CBCentralManager.connect(_:options:) queue a pending connection request that should be serviced when a matching directed advertisement is received? If so, are there circumstances in which this behavior differs by iPad hardware or controller implementation? . Is there any public diagnostic information, entitlement, or supported API that could help us determine why a pending CoreBluetooth connection request does not result in a connection attempt in this scenario? . Does Apple recommend a specific compatibility approach for legacy BLE DFU bootloaders that use directed advertising, beyond updating the accessory firmware to use ordinary undirected advertising? . We can provide packet captures from both the working and failing cases, including timestamps, directed-advertisement target addresses, and the absence/presence of the subsequent connection indication. Thank you for any guidance on whether this is expected behavior, a known compatibility limitation, or if there is anything we could try on our end to hopefully resolve this issue.
1
0
64
1d
Sanboxed Apps Reading Extended Security Information (ACL)
My custom filesystem kernel extension stores ACLs as an extended attribute, com.apple.system.Security. Sanboxed apps such as TextEdit, Pages, etc., running as a non-privileged process, fail to save modified contents when permissive ACLs are in use. Running them as a privileged process, does allow for file changes to be saved though. Non-sandboxed apps, such as VSCode, and command line programs are not susceptible to this behaviour. APFS, on the other hand, seems to handle ACLs as an ATTR_CMN_EXTENDED_SECURITY filesystem attribute, rather than as an EA. In this case, sandboxed apps have no trouble accessing the ACL data. I implemented a minimal PoC within my custom kext to verify this. I construct an ACL in memory allowing a given user to write,append,delete file contents, and return it that via vnop_getattr. This allows the file contents to be modified and saved by sandboxed apps. Can you please confirm if my findings are accurate and sandboxed apps fail to read the com.apple.system.Security EA by design? Also, Is it an accurate assumption, that ACLs should be handled either as an EA, or an ATTR_CMN_EXTENDED_SECURITY, but not both? Thanks.
12
0
869
1d
macOS 27.2 b2: Contacts app freezes for several seconds on every contact card
What happens Since installing macOS 27.2 b2 (didn't go through b1, might have been there already), the Contacts app has become almost unusable on my two Macs. Opening a contact or moving to the next one often freezes the app for 8 to 10 seconds, with the spinning wheel. It happens many times in a row while browsing the address book. It comes back no matter what I try: restarting, letting iCloud resync the contacts, deleting and recreating cards. Once, it seemed to go away for a couple of minutes upon restarting, but it returned. Both Macs share the same iCloud account (~690 contacts): a MacBook Pro M4 Pro and a Mac mini M4, both on 27.2 b2 (26B5091g). Reported as FB24928119. Technical details All 18 Contacts_*.spin reports show the main thread blocked in CNCDContactFetcher withLockedContext_fetchPosterData, waiting on a synchronous XPC call to com.apple.contacts.poster.api. That service is postersyncd, which syncs Contact Posters. The kernel kills postersyncd with exceeded mem limit: InactiveHard 20 MB (fatal) at 30–35 MB. launchd relaunches it every ~10 s: 74 kills in 26 h on one Mac, 54 in 24 h on the other. log stream --level debug shows the same sequence on every relaunch: START: Background cleanup → Potential cleanup for missingLocalContactIdentifiers → FetchingContacts → killed within the same second. The cleanup never finishes, so it restarts forever. The poster store (group.com.apple.contacts/ContactsMetadata) is ~85 MB, with blobs of up to 9 MB each. The memory limit stays InactiveHard even while Contacts is frontmost. Moving the poster store aside doesn't help: iCloud rebuilds it in ~25 s. Posters deleted from iOS or iCloud.com get a deletion date but are never purged. Question: has anyone else seen this on 27.2 b2? Is there a way to reset the Contact Posters data stored in iCloud?
0
0
81
1d
macOS 27.2 b2: Contacts app freezes for several seconds on every contact card
What happens Since installing macOS 27.2 b2, the Contacts app has become almost unusable on my two Macs. Opening a contact or moving to the next one often freezes the app for 8 to 10 seconds, with the spinning wheel. It happens many times in a row while browsing the address book. It comes back no matter what I try: restarting, letting iCloud resync the contacts, deleting and recreating cards. Once, it seemed to go away after restarting, but it returned after a couple of minutes into using Contacts again. Both Macs share the same iCloud account (~690 contacts): a MacBook Pro M4 Pro and a Mac mini M4, both on 27.2 b2 (26B5091g). Reported as FB24928119. Technical details All 18 Contacts_*.spin reports show the main thread blocked in CNCDContactFetcher withLockedContext_fetchPosterData, waiting on a synchronous XPC call to com.apple.contacts.poster.api. That service is postersyncd, which syncs Contact Posters. The kernel kills postersyncd with exceeded mem limit: InactiveHard 20 MB (fatal) at 30–35 MB. launchd relaunches it every ~10 s: 74 kills in 26 h on one Mac, 54 in 24 h on the other. log stream --level debug shows the same sequence on every relaunch: START: Background cleanup → Potential cleanup for missingLocalContactIdentifiers → FetchingContacts → killed within the same second. The cleanup never finishes, so it restarts forever. The poster store (group.com.apple.contacts/ContactsMetadata) is ~85 MB, with blobs of up to 9 MB each. The memory limit stays InactiveHard even while Contacts is frontmost. Moving the poster store aside doesn't help: iCloud rebuilds it in ~25 s. Posters deleted from iOS or iCloud.com get a deletion date but are never purged. Question: Has anyone else seen this on 27.2 beta? Is there a way to reset the Contact Posters data stored in iCloud?
0
0
68
1d
macOS 27.2 Beta 2 - High Power Mode broken on MacBook Pro 14" M5 Pro (Mac17,9)
Subject: Hard SMC and Kernel bug on 14" MacBook Pro M5 Pro (Mac17,9) in Build 26B5091g - High Power Mode completely unresponsive Hello CoreOS and Apple Silicon Performance Engineering Teams, I am writing to report a severe, reproducible system-level regression regarding High Power Mode and SMC power distribution on the new 14-inch MacBook Pro with the M5 Pro chip (Model Identifier: Mac17,9), currently running macOS 27.2 Beta 2 (Build 26B5091g). The issue prevents the M5 Pro hardware from scaling its cooling and power envelope correctly, rendering High Power Mode completely broken regardless of the power source (tested with both official 96W and 140W Apple power adapters). Key technical diagnostic findings from my device: Kernel vs UI State Mismatch: Running pmset -g via Terminal returns powermode 2, proving that the kernel registers High Power Mode as active. However, the System Information profile reader (Hardware -> Power) shows a direct conflict: "High Power Mode: No" and "Low Power Mode: Yes" (Режим энергосбережения: Да). Unresponsive SMC & Fan Curves: The cooling hardware remains completely unresponsive to the high-performance toggle. The fans fail to engage the pre-emptive 4500-5000 RPM cooling curve under heavy compute or gaming loads, remaining locked in the silent "Automatic" profile, which causes artificial thermal constraints. Powermetrics Telemetry Anomalies: A raw powermetrics trace captured during this state reveals a severe thread management bug: The P0-Cluster (High-Performance cores) shows a down residency of 98.88%, meaning the heavy performance cores are effectively kept asleep by the OS governor during high-power configuration. Combined Power (CPU + GPU + ANE) drops to a mere 429 mW. The thermal sampler entirely fails to pull hardware RPM telemetry from the SMC fan loops, providing only a generic "Current pressure level: Nominal" string. This profile behavior confirms that the macOS 27.2 power governor layer is suffering from a hard breakdown in SMC communication specific to the J614/Mac17,9 platform. The operating system handles the software flag but fails to pass the physical instruction downstream to the hardware control registers. Please prioritize this issue for the next macOS 27.2 beta cycle to ensure full thermal and compute optimization for the M5 Pro architecture prior to the final public release. I have attached the complete sysdiagnose archive, terminal configuration text files, and raw powermetrics logs. Thank you for your dedication to Apple Silicon optimization. FB24929043
3
0
63
1d
iOS 27.0 crash in UIEditMenuInteraction: BUG_IN_CLIENT_OF_TARGETED_PREVIEW__VIEW_IS_NOT_IN_A_WINDOW
We are seeing an intermittent production crash on iOS 27.0 while the system text-editing menu is active. Environment Device: iPhone 15 OS: iOS 27.0 Orientation: Portrait Xcode: [Xcode 26.4] Detail: Fatal Exception: NSInternalInconsistencyException 0 CoreFoundation 0x98190 __exceptionPreprocess 1 libobjc.A.dylib 0xc380 objc_exception_throw 2 Foundation 0x426ae0 -[NSMutableDictionary(NSMutableDictionary) initWithContentsOfFile:] 3 UIKitCore 0xca4e48 BUG_IN_CLIENT_OF_TARGETED_PREVIEW__VIEW_IS_NOT_IN_A_WINDOW 4 UIKitCore 0x66f558 -[UITargetedPreview initWithView:parameters:] 5 UIKitCore 0x1699cb0 -[UIEditMenuInteraction _contextMenuInteraction:configurationForMenuAtLocation:completion:] 6 UIKitCore 0x174cff8 -[UIContextMenuInteraction _interactionShouldBeginAtPoint:completion:] 7 UIKitCore 0x174a48c -[UIContextMenuInteraction _presentMenuAtLocation3D:] 8 UIKitCore 0x16999a8 -[UIEditMenuInteraction _editMenuPresentation:handoffDisplayedMenuWithContext:] 9 UIKitCore 0x15bf75c -[_UIEditMenuContentPresentation _performContextMenuHandoffForMenu:sourceView:] 10 UIKitCore 0x15bf610 -[_UIEditMenuContentPresentation editMenuListViewDidActivateHandoff:source:] 11 UIKitCore 0xd52810 -[_UIEditMenuListView _performHandoffFromSourceView:] 12 UIKitCore 0x5740c4 -[UIApplication sendAction:to:from:forEvent:] 13 UIKitCore 0x573ef4 -[UIControl sendAction:to:forEvent:] 14 UIKitCore 0x5737f8 -[UIControl _sendActionsForEvents:withEvent:] 15 UIKitCore 0x6d1e94 -[UIButton _sendActionsForEvents:withEvent:] 16 UIKitCore 0xd53bb8 -[_UIEditMenuListView _selectItemAtIndexPath:] 17 UIKitCore 0xd53104 -[_UIEditMenuListView _handleSelectionGesture:] 18 UIKitCore 0x5e798c -[UIGestureRecognizerTarget _sendActionWithGestureRecognizer:] 19 UIKitCore 0x5e77fc _UIGestureRecognizerSendTargetActions 20 UIKitCore 0x5e7580 _UIGestureRecognizerSendActions 21 UIKitCore 0xe4b30 -[UIGestureRecognizer _updateGestureForActiveEvents] 22 UIKitCore 0xe4984 -[UIGestureRecognizer gestureNode:didUpdatePhase:] 23 Gestures 0xcdac __swift_memcpy8_8 24 Gestures 0x397acc block_destroy_helper.6 25 Gestures 0xd514 __swift_memcpy8_8 26 Gestures 0xa87c __swift_memcpy8_8 27 Gestures 0x1a608 __swift_closure_destructor.8 28 UIKitCore 0xea41c -[UIGestureEnvironment _updateForEvent:window:] 29 UIKitCore 0xec298 -[UIWindow sendEvent:] 30 UIKitCore 0x5e5874 -[UIApplication sendEvent:] 31 UIKitCore 0xe2bdc __dispatchPreprocessedEventFromEventQueue 32 UIKitCore 0x6ad78 updateCycleEntry 33 UIKitCore 0x69b88 _UIUpdateSequenceRunNext 34 UIKitCore 0x69928 schedulerStepScheduledMainSectionContinue 35 UpdateCycle 0xbc0 UC::DriverCore::continueProcessing() 36 CoreFoundation 0x267cc __CFMachPortPerform 37 CoreFoundation 0x4a24c CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION 38 CoreFoundation 0x4a45c __CFRunLoopDoSource1 39 CoreFoundation 0x3a634 __CFRunLoopRun 40 CoreFoundation 0x3b7f4 _CFRunLoopRunSpecificWithOptions 41 GraphicsServices 0xf24 GSEventRunModal 42 UIKitCore 0xba1cc UIApplicationMain 43 flashexpress 0x303948 main + 17 (AppDelegate.swift:17) 44 ??? 0x1810675b8 (缺失)
1
0
51
1d
vmnet_network_ref loses its DHCP reservations and port-forwarding rules when its last interface leaves
I'm using the macOS 26 vmnet network API with Virtualization framework (vmnet_network_create + VZVmnetNetworkDeviceAttachment) and giving each VM a stable address with vmnet_network_configuration_add_dhcp_reservation, plus creation-time rules from vmnet_network_configuration_add_port_forwarding_rule. Both work on the network's first run. But if the network's last interface leaves while I still hold the vmnet_network_ref, then the next interface start brings the network back without its reservations or forwarding rules. The subnet and gateway are kept. How it shows up in practice: a VM that is the only guest on its network gets restarted from inside the guest. Virtualization framework removes and re-adds the VM's vmnet interface about 1 s apart, with no delegate callback. That's enough to stop and restart the network, and the guest comes back on a dynamic lease with its forwarded ports refused. Minimal repro, no VM needed: Create a configuration in VMNET_SHARED_MODE with set_ipv4_subnet, one add_dhcp_reservation and one add_port_forwarding_rule, then call vmnet_network_create. vmnet_interface_start_with_network. InternetSharing logs port forwarding enabled …, and /etc/bootptab contains the reservation. vmnet_stop_interface. InternetSharing logs no internal interface left, stopping network → reset to idle, and /etc/bootptab is emptied. vmnet_interface_start_with_network again on the same, still-retained ref. InternetSharing logs has been started with no port forwarding enabled line, and /etc/bootptab is never rewritten. The forwarded port is refused. Control: release the ref, call vmnet_network_create again from the same configuration, and start an interface. The reservation and the rule are both back. Reproduced on macOS 27.0 (26A428) and (with a minimal vmnet only test, no actual VM) on macOS 26.6.2 (25G83). This seems to contradict the documentation for vmnet_network_create: "The lifetime of such reservation is the same as that of vmnet_network_ref." A related issue: vmnet_interface_add_ip_port_forwarding_rule and its remove and get counterparts return VMNET_FAILURE synchronously on an interface started with vmnet_interface_start_with_network. The same calls work on a vmnet_start_interface interface. The add_port_forwarding_rule documentation points to those calls for managing rules after start, so there's no way to put a rule back after the restart. The same "torn down on last detach while the ref lives on" lifecycle is also reported in apple/container#2051 (https://github.com/apple/container/issues/2051), with a different symptom (two networks sharing a bridge, so tearing one down breaks the other's egress). It proposes the same mitigation: an anchor interface held with vmnet_interface_start_with_network. Filed as: FB24895271: reservations and rules discarded when the last interface is removed FB24895264: the runtime forwarding calls fail on network-attached interfaces FB24895282: suggestion for a network state-change callback and a DHCP lease query by MAC Questions: Is losing reservations and rules when the network goes idle intended? Is holding an app-owned interface on the network (via vmnet_interface_start_with_network) so it never reaches zero interfaces a supported workaround, or does it risk other side effects?
1
0
270
1d
MacOS 27 EULA: Written agreement to run more than 2 VMs per machine?
The language in the new EULA seems to indicate we can get permission to run more than 2 VMs on a single host. "(iii) except as otherwise provided in writing, signed, or issued by an authorized representative of Apple, to install, use and run up to two (2) additional copies or instances of the Apple Software, or any prior macOS or OS X operating system software or subsequent release of the Apple Software, within virtual operating system environments on each Apple-branded computer you own or control that is already running the Apple Software, for purposes of: (a) software development; (b) testing during software development; (c) using macOS Server; or (d) personal, non-commercial use." This is important because we often have use-cases that require running docker containers and other Virtualization tools along-side of two VMs on the host and obviously cant. What's the steps we can take to get written permission for this? Thank you!
6
2
276
1d
Restartable Sequences. What are they?
After scouring the XNU kernel source code, I came across restartable ranges [1]. They seem to be a task-level version of the the part of Linux's restartable sequences [2] for user requested synchronization [3] (akin to MEMBARRIER_CMD_RSEQ). Because of their differences, I would like to know more about how they work and what they are used for. From what I have gathered [4], they seem to be closer to RCU [5] that waits for eviction (as opposed to completion). But the fact that they are barely mentioned anywhere (see [4]) in the XNU source code I'd be really happy if you can point me to more information about them and how they compare to rseq (or rcu). What are the XNU devs planning on doing with them? [1] osfmk/kern/restartable.c: https://github.com/apple-oss-distributions/xnu/blob/f6217f8/osfmk/kern/restartable.c [2] https://criu.org/Restartable_Sequences [3] as opposed to (what I think is what makes rseq really cool) automatic eviction on preemption/CPU migration [4] there seems to be very little information online (including this forum) and the only places inside the XNU kernel source trees that aren't tests are in osfmk/kern/{thread,thread,sched_prim}.{c,h}, which doesn't really give much more information. [5] Read-Copy-Update: https://www.kernel.org/doc/html/latest/RCU/whatisRCU.html
1
0
73
1d
Sandboxed SMAppService LaunchDaemon: supported identity and persistent storage?
Technology: Service Management (SMAppService), App Sandbox, launchd, Foundation file URLs. This is a documentation/support question based on a standalone signed probe. It is not an assertion of a confirmed Apple defect, and it is not a duplicate of the launchd enhancement FB24726121 referenced in DTS thread 844906. Request Please clarify the supported identity and persistent-storage architecture for this combination of requirements. We need a sandboxed Mac App Store app to install its bundled, sandboxed SMAppService LaunchDaemon through one in-app action and the required native approval. The LAN listener must be unprivileged and remain available after logout and at boot. On macOS 27.2 beta 1 (26B5086k), our signed app-like probe launches and accesses its private container as the default root identity. We have read DTS thread 844906’s single-process privilege-drop guidance; this request concerns the additional sandbox, storage, and distribution limits. Observations • UserName=nobody exits during sandbox initialization with /var/empty home and secinitd UID errors. • An existing non-root account control also traps in libsecinit before main. • SessionCreate=true with that existing non-root account still terminates in libsecinit before main. • Creating a new audit session did not resolve sandbox initialization in this probe. • A retained directory descriptor works with openat after dropping privileges, but ordinary container paths and /dev/fd/directory/child do not. • All diagnostic registrations were removed for these tests; no product data or network listener was involved. Questions Is a sandboxed bootstrap that permanently drops groups, GID, and UID before opening a LAN listener a supported architecture for the Mac App Store distribution lane? How should such a LaunchDaemon obtain an isolated service identity and persistent container with Foundation/MLX-compatible file URLs without an external installer, shared writable storage, manual account/ACL setup, or unsupported sandbox exceptions? Please identify the supported public-API path, and clearly distinguish Service Management support from App Review guideline 2.4.5 constraints. If these requirements cannot be combined, please state which ones are mutually exclusive. Reference: https://developer.apple.com/forums/thread/844906 Expected outcome: documented guidance on a supported arrangement, or a clear statement of which requirements cannot be combined. We are withholding the product’s Release host installation until the identity/storage design is qualified.
2
0
104
2d
Python3 update
we are currently found the vulnerability about Python 3, but it is located under "/usr/bin/python3" does anyone know how to update this? we try to update python app, but it doesn't fix this, since it is under /usr/local/bin....
4
0
1.5k
2d
watchOS CoreBluetooth: BLE link stability, AutoReconnect and reduced reconnection range
I have a watchOS app communicating with a BLE peripheral during an active HKWorkoutSession. The workout provides sufficient runtime: once connected, the Watch can receive a notifying GATT characteristic approximately once per minute for hours, including while the display is off. In normal conditions the connection is very stable. The difficult case is outdoor use with marginal RF conditions. The peripheral and application protocol otherwise work reliably, but outdoors there are fewer reflected RF paths and normal body movement can intermittently obstruct the Watch-to-peripheral path. In those situations the link occasionally terminates with CBError.connectionTimeout. Reconnection is particularly important because this peripheral advertises for reconnection only approximately once per minute. We also know approximately which second of each minute the peripheral becomes active, so missing a single advertising opportunity can cause a relatively long data gap. I’m trying to better understand the supported CoreBluetooth/watchOS behavior in this situation. Maintaining a marginal existing connection Once the BLE connection is established, are there any public CoreBluetooth mechanisms or recommended practices for making that connection more robust against CBError.connectionTimeout? In particular, can application-level GATT activity have any influence on connection scheduling or link robustness, or is this entirely handled by the Bluetooth stack below CoreBluetooth? CBConnectPeripheralOptionEnableAutoReconnect with sparse advertising When CBConnectPeripheralOptionEnableAutoReconnect is enabled and the connection is lost, how does watchOS handle a peripheral that advertises only very infrequently? Does CoreBluetooth simply keep the reconnect pending and wait for subsequent advertisements indefinitely, subject to system policy? Known peripheral activity timing If the app knows approximately when the peripheral becomes active and advertises each minute, is there any supported way to make use of that timing during reconnection? Or should the app simply leave AutoReconnect pending and let CoreBluetooth handle reception? WWDC22 reduced reconnection range WWDC22 session 10135 says: “If your device is on the edge of Bluetooth range and repeatedly disconnects while in Background BLE connection, the reconnection range will be reduced. This means only devices close to the Apple Watch will reconnect.” The session also says these limits are counted over a rolling 24-hour window and are reset when the user interacts with the app. I would particularly appreciate clarification of how this works in practice: What conditions cause a disconnect to count toward this policy? Does this policy apply while an app has an active HKWorkoutSession and continues executing in the background? Is the state maintained per peripheral, per app, or more globally? What exactly constitutes the user interaction that resets it? Does bringing an already-running workout app back to the foreground reset it, or does the app need to be relaunched? Is there any public API or diagnostic indication that reduced reconnection range is currently active? Is there any supported way to explicitly clear/reset that state? Connection parameters Does watchOS expose any supported mechanism for a CoreBluetooth central to influence parameters relevant to connection robustness, such as connection interval, supervision timeout, PHY, transmit power, or similar link parameters? Diagnosing CBError.connectionTimeout When CoreBluetooth reports CBError.connectionTimeout, is there any supported diagnostic method to determine whether the Watch stopped receiving the peripheral, the peripheral stopped receiving the Watch, or whether this should simply be treated as a link-layer timeout without attribution to either side? For context, this is not primarily a background-runtime problem. The active workout keeps the app running and the normal persistent BLE connection can operate flawlessly for many hours. I’m specifically trying to understand the best supported strategy for preserving and recovering the BLE link when RF conditions temporarily become marginal, especially with a peripheral that advertises very sparsely after a disconnect. DTS asked me to post this question here for review.
0
0
48
3d
Supported filesystem quota boundary for VZMacOSInstaller temporary writes
On Apple silicon with macOS 26.6.2 (25G83), I am preparing a small synthetic VM using Swift and public Virtualization.framework APIs. Before invoking VZMacOSInstaller, I need to establish a hard aggregate allocation bound covering its temporary extraction data and relevant helper caches, not just the supplied restore image, guest disk and auxiliary-storage URLs. The application-owned artifacts would be placed inside a fixed-size, capped filesystem. Unknown installer scratch remains part of the byte budget. Sampling free space or cancelling after a threshold is crossed is not a substitute for filesystem enforcement in this design. No installer has been started for this trial; this is an API-design question, not a reproduced installation failure. Is there a supported mechanism to select or constrain the filesystem for all VZMacOSInstaller and relevant helper temporary writes? In particular, is there a documented binding between a caller's temporary directory and independently managed installer-service storage, or another supported aggregate quota design? If the public API cannot provide this guarantee, an explicit statement of that limitation would help. I am not seeking private parameters, managed-container relocation, disabled system protections, or undocumented sandbox overrides.
1
0
164
3d
Can guestDidStopVirtualMachine distinguish clean Linux shutdown from panic/watchdog/emergency stop?
I’m using Virtualization.framework on Apple silicon with a Linux guest (VZGenericPlatformConfiguration + VZLinuxBootLoader). The VM is intentionally minimal: 2 vCPUs, 2 GiB RAM 1 virtio entropy device 2 virtio block devices (base read-only, scratch read-write) 1 virtio console with 2 ports, both isConsole = false no serial, network, sharing, socket, USB, audio, graphics, keyboard, pointing, balloon, or custom virtio devices no EFI variable store nested virtualization disabled On the normal success path the host does not call requestStop(). A destructive host stop is tracked separately and treated as failure. I need a supported way for the host to distinguish: a clean Linux guest shutdown intentionally issued by the guest after its application protocol and cleanup have completed, from an abnormal or independent shutdown path such as kernel panic, watchdog, thermal / hardware-protection shutdown, emergency shutdown, or another kernel/platform-triggered stop. guestDidStopVirtualMachine tells me that the guest stopped, but I cannot find a public contract that says which Linux/kernel/platform histories can produce that callback, nor a public shutdown reason/initiator value. My specific questions are: For VZGenericPlatformConfiguration + VZLinuxBootLoader, what is the documented complete guest-visible shutdown/reset event surface, including implicit platform events not represented by explicitly configured device arrays? What Linux-facing mechanism does VZVirtualMachine.requestStop() use in this configuration? Can guestDidStopVirtualMachine also be emitted after panic, watchdog, thermal/hardware-protection shutdown, emergency shutdown, or another guest-kernel/platform shutdown source? Are those abnormal cases guaranteed to arrive through virtualMachine(_:didStopWithError:) instead? If guestDidStopVirtualMachine can represent multiple terminal histories, is there any supported public API or documented guarantee that lets the host distinguish a clean guest system-off from the abnormal/platform-triggered cases? If not, is it correct to treat this distinction as unspecified by the public Virtualization.framework contract? I do not need private implementation details. A public/supported contract describing which terminal histories can produce each delegate callback would be enough. This matters because the host is fail-closed: it must accept PASS only after an application-level success condition and a clean guest shutdown. A successful runtime observation alone is not enough for the qualification. Environment: Apple silicon / arm64 macOS 26.6.2 (25G83) public Virtualization.framework APIs
2
0
188
3d
Why are symbolic followed when installating a .pkg payload?
In macOS Tahoe 26.7 or Sequoia 15.7.5 (and probably other prior versions), when you install a .pkg, symlinks are followed: i.e. if your payload install a file to /Users/Shared/my-folder and, on the target volume, the /Users/Shared/my-folder item is a symbolic link to /Users/Shared/actual-folder, the file will be installed inside /Users/Shared/actual-folder. It used to be possible to tell the installation framework/mechanism not to follow symbolic links by using the followSymLinks attribute in the raw package PackageInfo file. And in this case, the symbolic link would be replaced by a real directory and the file would be installed where it was supposed to be installed. This attribute is apparently not taken into account anymore by the framework/mechanism. [Q] Is this on purpose or is it a bug (in shove for instance)? If it is on purpose, why was it considered a good idea to always follow symbolic links considering the security issues this can create?
3
0
527
3d
macOS grants half the connection-event airtime that iOS does, for the same accessory
We make a BLE peripheral that streams continuously. It's been running against Android, Windows, macOS and iOS for years. Android and Windows sit at ~1000 kbps and stay there — many host devices, many OS versions, no per-host tuning. macOS and iOS give us about half that. We've sniffed the BLE link using a Bluetooth sniffer to find out where it goes. Same board, same firmware, every session. Read off the air trace, not from host APIs: 2M PHY both directions (LL_PHY_UPDATE_IND 0x02 / 0x02) DLE max_tx_octets = 251 ATT MTU 247 15.00 ms interval, peripheral latency 0 no encryption no other BLE or BT Classic connections active during the session (all other devices removed and forgotten) WiFi turned off for around half of the sessions, didn't seem to make any difference Peripheral airtime per connection event: central airtime/event duty @ 15 ms throughput Android 11.14 ms 74% 995 kbps, sustained Windows ≥10.70 ms ≥71% ~1000 kbps, sustained macOS 6.96 ms 46% 561 kbps iOS 6.96 ms typical 46% ~560–600 kbps macOS comes out median 6.96, p90 6.96, max 7.09 across a whole session. Same number every time. iOS normally sits in the same place, with occasional brief excursions up to Android-like performance before dropping back down. Those excursions are worth describing, because they're the interesting part. In a handful of sessions out of many, iOS runs at 12.53 ms, 84% duty, ~1030 kbps. It never holds. It drops back inside 150 ms, with no renegotiation, no parameter change and no channel-map change anywhere in the trace. Sometimes it parks at 8.35 ms for ten seconds before moving again. This isn't us saying iOS is fine in practice — it clearly isn't, we can't ship against it. The point is that the radio and the stack demonstrably can fill a 12.53 ms event when they're allowed to, so whatever is holding them to 6.96 ms isn't a hardware ceiling. "It's a factor of ability" doesn't fit. This has been asked before and answered. In thread 774487, asked directly whether iOS limits packets per connection event to 4: "there is no 'limiting' going on as it is commonly understood ... We find that 4 is a more commonly true number than 6 or more some chipsets claim." In thread 770717, to a developer on iOS 18.2 running the same parameters we are: "iOS does not 'limit' the number of writes. It is just a factor of ability." Both answers need the accessory to be the variable. Ours isn't — same board, same firmware, minutes apart, and two non-Apple hosts take it to 1000 kbps and hold it indefinitely. The only thing that changes is which OS is acting as central. We don't think this can be explained by chipset capability when the chipset is the one thing held constant. It's airtime, not packet count. The "4 packets per connection event" number people quote here is the wrong unit, and we think that's why these threads go nowhere. Within one regime, as PDUs per event go up, PDU size goes down and the airtime doesn't move: iOS 9 PDUs @ 250.4 B -> 12.51 ms 10 PDUs @ 211.1 B -> 12.32 ms 11 PDUs @ 186.4 B -> 12.47 ms macOS 5 PDUs @ 239.4 B -> 6.73 ms 6 PDUs @ 178.1 B -> 6.60 ms Nothing is counting packets. The event closes on a clock. Count and airtime were the same measurement back when everything was 1M PHY and 27-byte PDUs — with 2M and DLE they aren't, and quoting a packet count now hides the mechanism instead of describing it. The peripheral isn't the limiter. The MD bit was set on the peripheral's last PDU in 2147 of 2148 connection events. It always had more data queued, and the central closed the event anyway. This isn't a new report. The same mechanism has been described here before. Thread 133092 (2019) reports macOS closing the connection event while the peripheral still has MD set — exactly what we measure. Thread 713349 reports "about 5 response packets per connection event," which is the same budget: 6.96 ms is 5 full-size PDUs. Thread 6025 reports a drop from 7 packets to 3. None of those received a reply. We're not raising them to relitigate old threads. The point is that three independent reports arriving at the same number across several years, on different accessories, points at a property of the scheduler rather than of anyone's hardware. On iOS, this looks like it changed in iOS 18. macOS has apparently behaved this way for years, going by the threads above. On iOS it's recent. We have video and screen recordings of this same peripheral tested on iOS 17, documented at the time as running consistently at around 1000 kbps. The behaviour described here started appearing when we moved to iOS 18. The firmware and the negotiated parameters are the same now as they were then, which points at a change in radio scheduling rather than anything on our side. What we're asking: Is the per-event airtime budget deliberate? ADG §55.6 and QA1931 cover interval, latency and timeout only. Neither mentions connection event length. Why do macOS and iOS give roughly half what Android and Windows give for the same accessory, and why can iOS reach 12.53 ms without staying there? Did anything change in iOS 18 around connection event scheduling? Is there anything we can do from the accessory or app side? We're already at 2M PHY, DLE 251, MTU 247 and the 15 ms floor. If the answer is "design for a floor, not a peak" — what's the floor? Right now we plan for ~560 kbps on Apple and roughly double that everywhere else, and that decides what we can ship, and whether we can count on Apple devices as a reliable platform for our product. Captures, recordings and analysis available if they're useful.
2
0
469
3d
Possible deadlock between es_mute_process_events and AUTH response on the same es_client_t
We occasionally observe es_mute_process_events() called on an es_client_t while an AUTH event delivered by the same client is still outstanding. In the problematic state, es_mute_process_events() stops returning inside IOConnectCallStructMethod. Subsequent calls to es_respond_flags_result() and a fallback es_respond_auth_result() on the same es_client_t also block in IOConnectCallStructMethod, eventually causing the AUTH deadline to be missed. We would like to clarify the concurrency semantics of these APIs: Is it supported to call es_mute_process_events() before responding to an outstanding AUTH event delivered by the same es_client_t? Can es_mute_process_events() wait for in-flight/outstanding AUTH processing? Are mute operations and es_respond_*() calls serialized internally for a single es_client_t? Can an in-progress mute operation prevent a concurrent es_respond_*() call from completing? Is the recommended pattern to respond to the AUTH message first and update mute state asynchronously afterward?
3
0
428
4d
Core OS Resources
General: DevForums subtopic: App & System Services > Core OS Core OS is a catch-all subtopic for low-level APIs that don’t fall into one of these more specific areas: Processes & Concurrency Resources Files and Storage Resources Networking Resources Network Extension Resources Security Resources Virtualization Resources Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"
Replies
0
Boosts
0
Views
2k
Activity
Aug ’25
Supported way for an arm64 process to map below the 4 GB __PAGEZERO floor?
Hi Quinn — following up from DTS case 22070584. I'm working on a Windows compatibility runtime (Wine plus a CPU translator) that runs natively on Apple Silicon. 64-bit x86 Windows programs work fine. 32-bit ones don't, because they need address space in the low 4 GB: guest pointers are 32-bit, and some Windows structures sit at fixed addresses like 0x7ffe0000 that programs read directly. On arm64 I can't get anything down there: task_info(TASK_VM_INFO) -> min_address 0x100ea0000 mmap(0x7ffe0000, MAP_FIXED) -> ENOMEM mach_vm_allocate(0x7ffe0000, VM_FLAGS_FIXED) -> KERN_INVALID_ADDRESS There's also nothing below 4 GB to remove: mach_vm_region finds no entry there at all, and mach_vm_deallocate(0, 4 GB) returns KERN_SUCCESS without changing anything. Building with a smaller __PAGEZERO doesn't help either — every size I tried (0x1000, 0x4000, 0x10000, 0x100000, 0x1000000, 0x10000000, 0x80000000) gets SIGKILLed before main, with no crash report. Ad-hoc signing, the hardened runtime and -no_pie made no difference. I did notice /usr/libexec/rosetta/runtime is arm64 with no __PAGEZERO segment at all and __TEXT at vmaddr 0, so the kernel can clearly do this, at least for platform binaries. Is there a supported way for a third-party arm64 process to map below 4 GB — an entitlement, a spawn attribute, something I've missed? If the answer is no, that's fine, I'd just like to know so I can stop looking and plan around it. I have two small test programs that print all of the above if they'd be useful.
Replies
6
Boosts
0
Views
747
Activity
19h
Kernel panic "m->m_flags & M_PKTHDR" in uipc_mbuf.c on SMB clients over 10 GbE (macOS 26)
We have a group of Macs that mount SMB shares over 10 GbE with jumbo frames (MTU 9000). Since late June, they have been kernel panicking several times a day with the same assertion: panic(cpu N caller ...): assertion failed: m->m_flags & M_PKTHDR, file: .../xnu/bsd/kern/uipc_mbuf.c, line: 4839 @uipc_socket.c:8260 Panicked thread: dlil_input_en0 Last started kext: com.apple.filesystems.smbfs 6.0.1 Environment Clients: Mac Studio (M1 Max and M1 Ultra) and Mac Pro (2019, Intel with T2), using the built-in 10GBASE-T at MTU 9000 macOS 26.5.1 (25F80), 26.6.2 (25G83) and 26.7 (25G229); it panics on all three Servers: Samba-based NAS, SMB 3.1.1, signing on, encryption off Filed as FB24912731 What we've found It still panics with our third-party EDR fully uninstalled. The Mac that panics needs an active SMB session. A Mac left on the network without a share mounted stayed up through several events that took down the others. Panics are often simultaneous across machines: two to six Macs, with different hardware and different macOS builds, within the same minute. It doesn't need sustained heavy throughput. Some panics came within minutes of reconnecting, during light editing. Setting kern.skywalk.flowswitch.rx_agg_tcp_host=0 did not help. The switch and server links stay up, and spanning tree doesn't change during these events. Only the Macs' ports drop. In one server-side capture, the client stopped sending within about 0.2 ms of receiving a READ response made of 8948-byte frames. That fits the panicked thread being dlil_input. Two existing threads look related Kernel panic using Vagrant synced folders via NFS beginning with macOS 15.4 (FB17853906). A DTS reply there said the issue is in kernel mbuf management and that SMB "is very likely to experience a similar panic." Incorrect packet handling in SMBClient MacOS 26, which describes a race in SMBClient under heavy load above about 10 Gbps. Questions Is this the same underlying issue as FB17853906, and is a fix planned for macOS 26? Our 2019 Mac Pros can't move to a later major release. Is there a known workaround, such as a sysctl, an nsmb.conf option, or a change to MTU or offload settings? Is there logging or a diagnostic we can leave enabled to capture more state at panic time? We can't reproduce this on demand, but between several machines we see it multiple times a day. We can provide full panic reports, sysdiagnoses, and packet captures from both client and server sides.
Replies
1
Boosts
0
Views
349
Activity
19h
macOS 26.7: opening Control Center Sound causes BLE HID mouse lag, HID service loss, and result 307
I am seeing a repeatable interaction between audio activity or audio-device discovery and a Bluetooth LE HID mouse on a Mac mini M2 Pro. Opening the detailed Sound panel in Control Center, or changing the HDMI audio output, makes the pointer stutter. Opening Apple’s Music.app has also caused a temporary complete loss of the mouse. In the worst cases, the mouse becomes completely unavailable and does not recover without Bluetooth troubleshooting or re-pairing. Configuration Mac mini Mac14,12, Apple M2 Pro, 32 GB RAM macOS Tahoe 26.7 (25G229) Also reproduced on macOS Tahoe 26.1 (25B78) Logitech MX Anywhere 3 Mac over Bluetooth LE VID 0x046D, PID 0xB025 Firmware MPM24.01_0015 Logitech MX Keys M Mac over Bluetooth LE PL4071UH display and audio output over HDMI Logi Options+ installed Trigger Connect the MX Anywhere 3 Mac and MX Keys over Bluetooth. Open Control Center from the menu bar. Open the detailed Sound panel, or change the HDMI audio output. Move the Bluetooth mouse continuously while audio-output discovery is taking place. The issue is intermittent, but it has been reproduced several times on both macOS 26.1 and 26.7. Pointer stuttering can continue after the Sound panel is closed. A later incident occurred when I opened Apple’s Music.app. The Bluetooth mouse became unavailable again, but this time it recovered automatically after approximately ten seconds. The Sony WH-1000XM6 headset was connected over Bluetooth, while the 512 GB USB flash drive was not connected. This shows that the USB drive is not required for a temporary mouse loss and makes concurrent Bluetooth audio activity a more relevant condition to investigate. The additional trigger suggests that the problem may not be limited to the Control Center interface itself and may also be associated with audio-subsystem initialization or audio-device activity. This is an observation, not yet a confirmed causal link. Additional condition in the permanent-loss cases In every incident where the mouse did not recover on its own and became effectively unusable, the following two devices were also present: a Sony WH-1000XM6 wireless headset connected over Bluetooth; a 512 GB SanDisk USB flash drive connected to the Mac. I am reporting this as a correlation, not as a confirmed cause. The headset adds simultaneous Bluetooth audio activity. The USB drive may or may not be relevant depending on its USB mode, activity, shielding, physical location, and possible 2.4 GHz interference. The 512 GB capacity is included only to identify the device. Less severe cursor stuttering has also been observed around Sound-panel discovery; the two devices above are specifically the common condition I recorded during the permanent mouse-loss incidents. Observed result The pointer starts stuttering and raw mouse HID reports develop multi-second gaps. In severe incidents, the Bluetooth mouse stops working entirely. Opening Music.app has also caused a temporary complete loss of the mouse; during that incident the Sony WH-1000XM6 was connected over Bluetooth, the USB flash drive was not connected, and the mouse recovered automatically after approximately ten seconds. Logi Options+ then displays the mouse as inactive. The mouse disappears from the IOHID tree, while the Bluetooth keyboard can remain present. A wired USB mouse remains responsive, so the Mac and pointer rendering are not completely frozen. The failure can persist after the Sound panel is closed. Relevant logs On macOS 26.7, bluetoothd repeatedly recorded the following sequence for the MX Anywhere 3 Mac: MX Anywhere 3 Mac needs low latency current connection parameters: interval 30.00 ms, latency 0 connection changed to: interval 7.50 ms, latency 44 Device "MX Anywhere 3 Mac" is Incompatible LE HID Device "MX Anywhere 3 Mac" does not have _HID_SERVICE_ Connection timed out disconnect result: 307 BLEPaired HIDBadBehavior Central The sequence repeated during automatic reconnection attempts. The mouse later recovered on some occasions, but other incidents required turning Bluetooth off for about 15 seconds, turning it back on, forgetting the mouse, and pairing it again. Instrumented reproduction During a monitored reproduction on macOS 26.1: detailed audio discovery started at +21.333 s; a 2.400 s gap in raw HID reports from the mouse occurred 0.899 s before that event; bluetoothd then reported a HID lag issue for VID 0x046D, PID 0xB025 at +1.897 s; no display-frame gaps were detected; there was no sustained CPU saturation. This indicates that the interruption is already present in the raw HID input stream. It does not appear to be only a cursor animation or WindowServer rendering delay. Expected result Discovering or switching audio outputs should not alter a separate BLE HID mouse connection, cause multi-second HID report gaps, remove _HID_SERVICE_, or disconnect the mouse. Technical points for investigation Could this be a macOS Bluetooth/HID connection-parameter or service-discovery problem triggered by concurrent audio discovery? In particular, why does macOS change the mouse from 30 ms / latency 0 to 7.5 ms / latency 44, then classify it as Incompatible LE HID, lose _HID_SERVICE_, and eventually disconnect it with result 307? Has anyone reproduced the same sequence with a Logitech BLE mouse, a Bluetooth audio headset, or a USB 3 storage device connected? The issue was also submitted through Apple’s public macOS feedback form on 24 September 2026. That form confirmed receipt but did not provide an FB case number. Possibly related report Another Developer Forums report describes a different BLE HID device with Incompatible LE HID and disconnect result 307 on macOS 27. The hardware and trigger are different, but the Bluetooth/HID failure signature may be related: https://developer.apple.com/forums/thread/845857
Replies
6
Boosts
0
Views
143
Activity
23h
CoreBluetooth reconnection to legacy BLE directed advertisements differs across iPad hardware
To whomever this may concern, We are investigating a BLE firmware-update compatibility issue affecting a legacy Nordic nRF51 DFU bootloader on a subset of iPads. We are seeking guidance on whether there are known CoreBluetooth or Bluetooth-controller differences across recent iPad hardware that could affect reconnection to Bluetooth LE connectable directed advertisements. Background Our accessory uses a legacy Nordic nRF51 DFU flow: The iPad is connected to the accessory’s normal application firmware. The app requests entry into DFU mode. The accessory disconnects normally. The accessory restarts into its bootloader. The bootloader sends connectable directed advertisements targeted at the iPad that initiated DFU. The iPad is expected to reconnect, after which the firmware transfer begins. Observed behavior On working iPads, the BLE trace shows: Application disconnect → accessory begins connectable directed advertising → iPad sends BLE connection indication → bootloader connection succeeds → DFU begins On affected iPads, the trace shows: Application disconnect → accessory begins the same connectable directed advertising → no connection indication from the iPad → DFU cannot proceed The accessory is advertising to the current resolvable address of the connected iPad. The bootloader starts directed advertising at nearly identical timing in both working and failing traces, approximately 456 ms after disconnect. The initial disconnect is normal in both cases: LL_TERMINATE_IND / Remote User Terminated Connection / reason 0x13 The problem occurs only after the accessory begins directed advertising. It seems like the iPad might be able to receive and listen to directed advertisement, however it seems to be unable to send back a connection indication. Hardware correlation observed so far We observed a correlation with Bluetooth controller vendor information visible in our BLE captures: FORMAT FOR FOLLOWING LINES Result -> Example device -> Observed controller vendor DFU succeeds -> iPad Air, 5th generation -> Broadcom DFU succeeds -> Other tested iPads, including one iPad with an A16-class platform -> Broadcom DFU fails -> One affected iPad with an A16-class platform -> MediaTek We want to be careful not to overstate this result: We have tested only one affected MediaTek-based iPad so far. The model string is MD3Y4LL/A and its current iOS version 26.6.1. The functioning Broadcomm iPads A16 we have tested that did not fail DFU process have model string MD7F4KN/A. The other iPad models we tested DFU on (which were all successful, albeit none of them were MediaTek chips, they were all Broadcomm) were: MRJN2KN/A, MM9C3KN/A, MQ6J3KN/A, MM6T3KN/A (the latter with iOS 26.6.1 as well, suggesting it is not necessarily an iPad OS version issue) We have not found a second MediaTek-based iPad to determine whether the behavior reproduces across that hardware. We initially suspected that recent non-cellular iPads might consistently use MediaTek, but this was disproved by the iPad Air, 5th generation we tested (MM9C3KN/A): it had no cellular connection and used Broadcom, and DFU worked normally. Therefore, we do not conclude that the issue is caused by MediaTek hardware. We only see a correlation worth investigating. What we have ruled out The target firmware image is not involved; failure occurs before any firmware data is transferred. The accessory reaches bootloader mode and sends directed advertisements at the expected time. The iOS Nordic DFU library already calls CoreBluetooth’s normal reconnect API: centralManager.connect(peripheral, options: nil) iOS does not expose an API allowing an app to create or send a raw Link Layer CONNECT_IND; therefore the application cannot directly work around controller-level connection behavior. The affected iPad does not provide a normal scanner/discovery callback for this directed bootloader advertisement, so matching by name or service UUID is not available as an application-layer workaround. Questions . Are there known CoreBluetooth, iPadOS, or Bluetooth-controller differences that can affect handling of BLE connectable directed advertisements, particularly when an accessory directs advertisements to a central using a resolvable private address? . Is there a recommended CoreBluetooth pattern for reconnecting to a known peripheral after it restarts into a legacy bootloader that uses directed advertising? . Does CBCentralManager.connect(_:options:) queue a pending connection request that should be serviced when a matching directed advertisement is received? If so, are there circumstances in which this behavior differs by iPad hardware or controller implementation? . Is there any public diagnostic information, entitlement, or supported API that could help us determine why a pending CoreBluetooth connection request does not result in a connection attempt in this scenario? . Does Apple recommend a specific compatibility approach for legacy BLE DFU bootloaders that use directed advertising, beyond updating the accessory firmware to use ordinary undirected advertising? . We can provide packet captures from both the working and failing cases, including timestamps, directed-advertisement target addresses, and the absence/presence of the subsequent connection indication. Thank you for any guidance on whether this is expected behavior, a known compatibility limitation, or if there is anything we could try on our end to hopefully resolve this issue.
Replies
1
Boosts
0
Views
64
Activity
1d
Sanboxed Apps Reading Extended Security Information (ACL)
My custom filesystem kernel extension stores ACLs as an extended attribute, com.apple.system.Security. Sanboxed apps such as TextEdit, Pages, etc., running as a non-privileged process, fail to save modified contents when permissive ACLs are in use. Running them as a privileged process, does allow for file changes to be saved though. Non-sandboxed apps, such as VSCode, and command line programs are not susceptible to this behaviour. APFS, on the other hand, seems to handle ACLs as an ATTR_CMN_EXTENDED_SECURITY filesystem attribute, rather than as an EA. In this case, sandboxed apps have no trouble accessing the ACL data. I implemented a minimal PoC within my custom kext to verify this. I construct an ACL in memory allowing a given user to write,append,delete file contents, and return it that via vnop_getattr. This allows the file contents to be modified and saved by sandboxed apps. Can you please confirm if my findings are accurate and sandboxed apps fail to read the com.apple.system.Security EA by design? Also, Is it an accurate assumption, that ACLs should be handled either as an EA, or an ATTR_CMN_EXTENDED_SECURITY, but not both? Thanks.
Replies
12
Boosts
0
Views
869
Activity
1d
macOS 27.2 b2: Contacts app freezes for several seconds on every contact card
What happens Since installing macOS 27.2 b2 (didn't go through b1, might have been there already), the Contacts app has become almost unusable on my two Macs. Opening a contact or moving to the next one often freezes the app for 8 to 10 seconds, with the spinning wheel. It happens many times in a row while browsing the address book. It comes back no matter what I try: restarting, letting iCloud resync the contacts, deleting and recreating cards. Once, it seemed to go away for a couple of minutes upon restarting, but it returned. Both Macs share the same iCloud account (~690 contacts): a MacBook Pro M4 Pro and a Mac mini M4, both on 27.2 b2 (26B5091g). Reported as FB24928119. Technical details All 18 Contacts_*.spin reports show the main thread blocked in CNCDContactFetcher withLockedContext_fetchPosterData, waiting on a synchronous XPC call to com.apple.contacts.poster.api. That service is postersyncd, which syncs Contact Posters. The kernel kills postersyncd with exceeded mem limit: InactiveHard 20 MB (fatal) at 30–35 MB. launchd relaunches it every ~10 s: 74 kills in 26 h on one Mac, 54 in 24 h on the other. log stream --level debug shows the same sequence on every relaunch: START: Background cleanup → Potential cleanup for missingLocalContactIdentifiers → FetchingContacts → killed within the same second. The cleanup never finishes, so it restarts forever. The poster store (group.com.apple.contacts/ContactsMetadata) is ~85 MB, with blobs of up to 9 MB each. The memory limit stays InactiveHard even while Contacts is frontmost. Moving the poster store aside doesn't help: iCloud rebuilds it in ~25 s. Posters deleted from iOS or iCloud.com get a deletion date but are never purged. Question: has anyone else seen this on 27.2 b2? Is there a way to reset the Contact Posters data stored in iCloud?
Replies
0
Boosts
0
Views
81
Activity
1d
macOS 27.2 b2: Contacts app freezes for several seconds on every contact card
What happens Since installing macOS 27.2 b2, the Contacts app has become almost unusable on my two Macs. Opening a contact or moving to the next one often freezes the app for 8 to 10 seconds, with the spinning wheel. It happens many times in a row while browsing the address book. It comes back no matter what I try: restarting, letting iCloud resync the contacts, deleting and recreating cards. Once, it seemed to go away after restarting, but it returned after a couple of minutes into using Contacts again. Both Macs share the same iCloud account (~690 contacts): a MacBook Pro M4 Pro and a Mac mini M4, both on 27.2 b2 (26B5091g). Reported as FB24928119. Technical details All 18 Contacts_*.spin reports show the main thread blocked in CNCDContactFetcher withLockedContext_fetchPosterData, waiting on a synchronous XPC call to com.apple.contacts.poster.api. That service is postersyncd, which syncs Contact Posters. The kernel kills postersyncd with exceeded mem limit: InactiveHard 20 MB (fatal) at 30–35 MB. launchd relaunches it every ~10 s: 74 kills in 26 h on one Mac, 54 in 24 h on the other. log stream --level debug shows the same sequence on every relaunch: START: Background cleanup → Potential cleanup for missingLocalContactIdentifiers → FetchingContacts → killed within the same second. The cleanup never finishes, so it restarts forever. The poster store (group.com.apple.contacts/ContactsMetadata) is ~85 MB, with blobs of up to 9 MB each. The memory limit stays InactiveHard even while Contacts is frontmost. Moving the poster store aside doesn't help: iCloud rebuilds it in ~25 s. Posters deleted from iOS or iCloud.com get a deletion date but are never purged. Question: Has anyone else seen this on 27.2 beta? Is there a way to reset the Contact Posters data stored in iCloud?
Replies
0
Boosts
0
Views
68
Activity
1d
macOS 27.2 Beta 2 - High Power Mode broken on MacBook Pro 14" M5 Pro (Mac17,9)
Subject: Hard SMC and Kernel bug on 14" MacBook Pro M5 Pro (Mac17,9) in Build 26B5091g - High Power Mode completely unresponsive Hello CoreOS and Apple Silicon Performance Engineering Teams, I am writing to report a severe, reproducible system-level regression regarding High Power Mode and SMC power distribution on the new 14-inch MacBook Pro with the M5 Pro chip (Model Identifier: Mac17,9), currently running macOS 27.2 Beta 2 (Build 26B5091g). The issue prevents the M5 Pro hardware from scaling its cooling and power envelope correctly, rendering High Power Mode completely broken regardless of the power source (tested with both official 96W and 140W Apple power adapters). Key technical diagnostic findings from my device: Kernel vs UI State Mismatch: Running pmset -g via Terminal returns powermode 2, proving that the kernel registers High Power Mode as active. However, the System Information profile reader (Hardware -> Power) shows a direct conflict: "High Power Mode: No" and "Low Power Mode: Yes" (Режим энергосбережения: Да). Unresponsive SMC & Fan Curves: The cooling hardware remains completely unresponsive to the high-performance toggle. The fans fail to engage the pre-emptive 4500-5000 RPM cooling curve under heavy compute or gaming loads, remaining locked in the silent "Automatic" profile, which causes artificial thermal constraints. Powermetrics Telemetry Anomalies: A raw powermetrics trace captured during this state reveals a severe thread management bug: The P0-Cluster (High-Performance cores) shows a down residency of 98.88%, meaning the heavy performance cores are effectively kept asleep by the OS governor during high-power configuration. Combined Power (CPU + GPU + ANE) drops to a mere 429 mW. The thermal sampler entirely fails to pull hardware RPM telemetry from the SMC fan loops, providing only a generic "Current pressure level: Nominal" string. This profile behavior confirms that the macOS 27.2 power governor layer is suffering from a hard breakdown in SMC communication specific to the J614/Mac17,9 platform. The operating system handles the software flag but fails to pass the physical instruction downstream to the hardware control registers. Please prioritize this issue for the next macOS 27.2 beta cycle to ensure full thermal and compute optimization for the M5 Pro architecture prior to the final public release. I have attached the complete sysdiagnose archive, terminal configuration text files, and raw powermetrics logs. Thank you for your dedication to Apple Silicon optimization. FB24929043
Replies
3
Boosts
0
Views
63
Activity
1d
iOS 27.0 crash in UIEditMenuInteraction: BUG_IN_CLIENT_OF_TARGETED_PREVIEW__VIEW_IS_NOT_IN_A_WINDOW
We are seeing an intermittent production crash on iOS 27.0 while the system text-editing menu is active. Environment Device: iPhone 15 OS: iOS 27.0 Orientation: Portrait Xcode: [Xcode 26.4] Detail: Fatal Exception: NSInternalInconsistencyException 0 CoreFoundation 0x98190 __exceptionPreprocess 1 libobjc.A.dylib 0xc380 objc_exception_throw 2 Foundation 0x426ae0 -[NSMutableDictionary(NSMutableDictionary) initWithContentsOfFile:] 3 UIKitCore 0xca4e48 BUG_IN_CLIENT_OF_TARGETED_PREVIEW__VIEW_IS_NOT_IN_A_WINDOW 4 UIKitCore 0x66f558 -[UITargetedPreview initWithView:parameters:] 5 UIKitCore 0x1699cb0 -[UIEditMenuInteraction _contextMenuInteraction:configurationForMenuAtLocation:completion:] 6 UIKitCore 0x174cff8 -[UIContextMenuInteraction _interactionShouldBeginAtPoint:completion:] 7 UIKitCore 0x174a48c -[UIContextMenuInteraction _presentMenuAtLocation3D:] 8 UIKitCore 0x16999a8 -[UIEditMenuInteraction _editMenuPresentation:handoffDisplayedMenuWithContext:] 9 UIKitCore 0x15bf75c -[_UIEditMenuContentPresentation _performContextMenuHandoffForMenu:sourceView:] 10 UIKitCore 0x15bf610 -[_UIEditMenuContentPresentation editMenuListViewDidActivateHandoff:source:] 11 UIKitCore 0xd52810 -[_UIEditMenuListView _performHandoffFromSourceView:] 12 UIKitCore 0x5740c4 -[UIApplication sendAction:to:from:forEvent:] 13 UIKitCore 0x573ef4 -[UIControl sendAction:to:forEvent:] 14 UIKitCore 0x5737f8 -[UIControl _sendActionsForEvents:withEvent:] 15 UIKitCore 0x6d1e94 -[UIButton _sendActionsForEvents:withEvent:] 16 UIKitCore 0xd53bb8 -[_UIEditMenuListView _selectItemAtIndexPath:] 17 UIKitCore 0xd53104 -[_UIEditMenuListView _handleSelectionGesture:] 18 UIKitCore 0x5e798c -[UIGestureRecognizerTarget _sendActionWithGestureRecognizer:] 19 UIKitCore 0x5e77fc _UIGestureRecognizerSendTargetActions 20 UIKitCore 0x5e7580 _UIGestureRecognizerSendActions 21 UIKitCore 0xe4b30 -[UIGestureRecognizer _updateGestureForActiveEvents] 22 UIKitCore 0xe4984 -[UIGestureRecognizer gestureNode:didUpdatePhase:] 23 Gestures 0xcdac __swift_memcpy8_8 24 Gestures 0x397acc block_destroy_helper.6 25 Gestures 0xd514 __swift_memcpy8_8 26 Gestures 0xa87c __swift_memcpy8_8 27 Gestures 0x1a608 __swift_closure_destructor.8 28 UIKitCore 0xea41c -[UIGestureEnvironment _updateForEvent:window:] 29 UIKitCore 0xec298 -[UIWindow sendEvent:] 30 UIKitCore 0x5e5874 -[UIApplication sendEvent:] 31 UIKitCore 0xe2bdc __dispatchPreprocessedEventFromEventQueue 32 UIKitCore 0x6ad78 updateCycleEntry 33 UIKitCore 0x69b88 _UIUpdateSequenceRunNext 34 UIKitCore 0x69928 schedulerStepScheduledMainSectionContinue 35 UpdateCycle 0xbc0 UC::DriverCore::continueProcessing() 36 CoreFoundation 0x267cc __CFMachPortPerform 37 CoreFoundation 0x4a24c CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION 38 CoreFoundation 0x4a45c __CFRunLoopDoSource1 39 CoreFoundation 0x3a634 __CFRunLoopRun 40 CoreFoundation 0x3b7f4 _CFRunLoopRunSpecificWithOptions 41 GraphicsServices 0xf24 GSEventRunModal 42 UIKitCore 0xba1cc UIApplicationMain 43 flashexpress 0x303948 main + 17 (AppDelegate.swift:17) 44 ??? 0x1810675b8 (缺失)
Replies
1
Boosts
0
Views
51
Activity
1d
vmnet_network_ref loses its DHCP reservations and port-forwarding rules when its last interface leaves
I'm using the macOS 26 vmnet network API with Virtualization framework (vmnet_network_create + VZVmnetNetworkDeviceAttachment) and giving each VM a stable address with vmnet_network_configuration_add_dhcp_reservation, plus creation-time rules from vmnet_network_configuration_add_port_forwarding_rule. Both work on the network's first run. But if the network's last interface leaves while I still hold the vmnet_network_ref, then the next interface start brings the network back without its reservations or forwarding rules. The subnet and gateway are kept. How it shows up in practice: a VM that is the only guest on its network gets restarted from inside the guest. Virtualization framework removes and re-adds the VM's vmnet interface about 1 s apart, with no delegate callback. That's enough to stop and restart the network, and the guest comes back on a dynamic lease with its forwarded ports refused. Minimal repro, no VM needed: Create a configuration in VMNET_SHARED_MODE with set_ipv4_subnet, one add_dhcp_reservation and one add_port_forwarding_rule, then call vmnet_network_create. vmnet_interface_start_with_network. InternetSharing logs port forwarding enabled …, and /etc/bootptab contains the reservation. vmnet_stop_interface. InternetSharing logs no internal interface left, stopping network → reset to idle, and /etc/bootptab is emptied. vmnet_interface_start_with_network again on the same, still-retained ref. InternetSharing logs has been started with no port forwarding enabled line, and /etc/bootptab is never rewritten. The forwarded port is refused. Control: release the ref, call vmnet_network_create again from the same configuration, and start an interface. The reservation and the rule are both back. Reproduced on macOS 27.0 (26A428) and (with a minimal vmnet only test, no actual VM) on macOS 26.6.2 (25G83). This seems to contradict the documentation for vmnet_network_create: "The lifetime of such reservation is the same as that of vmnet_network_ref." A related issue: vmnet_interface_add_ip_port_forwarding_rule and its remove and get counterparts return VMNET_FAILURE synchronously on an interface started with vmnet_interface_start_with_network. The same calls work on a vmnet_start_interface interface. The add_port_forwarding_rule documentation points to those calls for managing rules after start, so there's no way to put a rule back after the restart. The same "torn down on last detach while the ref lives on" lifecycle is also reported in apple/container#2051 (https://github.com/apple/container/issues/2051), with a different symptom (two networks sharing a bridge, so tearing one down breaks the other's egress). It proposes the same mitigation: an anchor interface held with vmnet_interface_start_with_network. Filed as: FB24895271: reservations and rules discarded when the last interface is removed FB24895264: the runtime forwarding calls fail on network-attached interfaces FB24895282: suggestion for a network state-change callback and a DHCP lease query by MAC Questions: Is losing reservations and rules when the network goes idle intended? Is holding an app-owned interface on the network (via vmnet_interface_start_with_network) so it never reaches zero interfaces a supported workaround, or does it risk other side effects?
Replies
1
Boosts
0
Views
270
Activity
1d
MacOS 27 EULA: Written agreement to run more than 2 VMs per machine?
The language in the new EULA seems to indicate we can get permission to run more than 2 VMs on a single host. "(iii) except as otherwise provided in writing, signed, or issued by an authorized representative of Apple, to install, use and run up to two (2) additional copies or instances of the Apple Software, or any prior macOS or OS X operating system software or subsequent release of the Apple Software, within virtual operating system environments on each Apple-branded computer you own or control that is already running the Apple Software, for purposes of: (a) software development; (b) testing during software development; (c) using macOS Server; or (d) personal, non-commercial use." This is important because we often have use-cases that require running docker containers and other Virtualization tools along-side of two VMs on the host and obviously cant. What's the steps we can take to get written permission for this? Thank you!
Replies
6
Boosts
2
Views
276
Activity
1d
Restartable Sequences. What are they?
After scouring the XNU kernel source code, I came across restartable ranges [1]. They seem to be a task-level version of the the part of Linux's restartable sequences [2] for user requested synchronization [3] (akin to MEMBARRIER_CMD_RSEQ). Because of their differences, I would like to know more about how they work and what they are used for. From what I have gathered [4], they seem to be closer to RCU [5] that waits for eviction (as opposed to completion). But the fact that they are barely mentioned anywhere (see [4]) in the XNU source code I'd be really happy if you can point me to more information about them and how they compare to rseq (or rcu). What are the XNU devs planning on doing with them? [1] osfmk/kern/restartable.c: https://github.com/apple-oss-distributions/xnu/blob/f6217f8/osfmk/kern/restartable.c [2] https://criu.org/Restartable_Sequences [3] as opposed to (what I think is what makes rseq really cool) automatic eviction on preemption/CPU migration [4] there seems to be very little information online (including this forum) and the only places inside the XNU kernel source trees that aren't tests are in osfmk/kern/{thread,thread,sched_prim}.{c,h}, which doesn't really give much more information. [5] Read-Copy-Update: https://www.kernel.org/doc/html/latest/RCU/whatisRCU.html
Replies
1
Boosts
0
Views
73
Activity
1d
Sandboxed SMAppService LaunchDaemon: supported identity and persistent storage?
Technology: Service Management (SMAppService), App Sandbox, launchd, Foundation file URLs. This is a documentation/support question based on a standalone signed probe. It is not an assertion of a confirmed Apple defect, and it is not a duplicate of the launchd enhancement FB24726121 referenced in DTS thread 844906. Request Please clarify the supported identity and persistent-storage architecture for this combination of requirements. We need a sandboxed Mac App Store app to install its bundled, sandboxed SMAppService LaunchDaemon through one in-app action and the required native approval. The LAN listener must be unprivileged and remain available after logout and at boot. On macOS 27.2 beta 1 (26B5086k), our signed app-like probe launches and accesses its private container as the default root identity. We have read DTS thread 844906’s single-process privilege-drop guidance; this request concerns the additional sandbox, storage, and distribution limits. Observations • UserName=nobody exits during sandbox initialization with /var/empty home and secinitd UID errors. • An existing non-root account control also traps in libsecinit before main. • SessionCreate=true with that existing non-root account still terminates in libsecinit before main. • Creating a new audit session did not resolve sandbox initialization in this probe. • A retained directory descriptor works with openat after dropping privileges, but ordinary container paths and /dev/fd/directory/child do not. • All diagnostic registrations were removed for these tests; no product data or network listener was involved. Questions Is a sandboxed bootstrap that permanently drops groups, GID, and UID before opening a LAN listener a supported architecture for the Mac App Store distribution lane? How should such a LaunchDaemon obtain an isolated service identity and persistent container with Foundation/MLX-compatible file URLs without an external installer, shared writable storage, manual account/ACL setup, or unsupported sandbox exceptions? Please identify the supported public-API path, and clearly distinguish Service Management support from App Review guideline 2.4.5 constraints. If these requirements cannot be combined, please state which ones are mutually exclusive. Reference: https://developer.apple.com/forums/thread/844906 Expected outcome: documented guidance on a supported arrangement, or a clear statement of which requirements cannot be combined. We are withholding the product’s Release host installation until the identity/storage design is qualified.
Replies
2
Boosts
0
Views
104
Activity
2d
Python3 update
we are currently found the vulnerability about Python 3, but it is located under "/usr/bin/python3" does anyone know how to update this? we try to update python app, but it doesn't fix this, since it is under /usr/local/bin....
Replies
4
Boosts
0
Views
1.5k
Activity
2d
watchOS CoreBluetooth: BLE link stability, AutoReconnect and reduced reconnection range
I have a watchOS app communicating with a BLE peripheral during an active HKWorkoutSession. The workout provides sufficient runtime: once connected, the Watch can receive a notifying GATT characteristic approximately once per minute for hours, including while the display is off. In normal conditions the connection is very stable. The difficult case is outdoor use with marginal RF conditions. The peripheral and application protocol otherwise work reliably, but outdoors there are fewer reflected RF paths and normal body movement can intermittently obstruct the Watch-to-peripheral path. In those situations the link occasionally terminates with CBError.connectionTimeout. Reconnection is particularly important because this peripheral advertises for reconnection only approximately once per minute. We also know approximately which second of each minute the peripheral becomes active, so missing a single advertising opportunity can cause a relatively long data gap. I’m trying to better understand the supported CoreBluetooth/watchOS behavior in this situation. Maintaining a marginal existing connection Once the BLE connection is established, are there any public CoreBluetooth mechanisms or recommended practices for making that connection more robust against CBError.connectionTimeout? In particular, can application-level GATT activity have any influence on connection scheduling or link robustness, or is this entirely handled by the Bluetooth stack below CoreBluetooth? CBConnectPeripheralOptionEnableAutoReconnect with sparse advertising When CBConnectPeripheralOptionEnableAutoReconnect is enabled and the connection is lost, how does watchOS handle a peripheral that advertises only very infrequently? Does CoreBluetooth simply keep the reconnect pending and wait for subsequent advertisements indefinitely, subject to system policy? Known peripheral activity timing If the app knows approximately when the peripheral becomes active and advertises each minute, is there any supported way to make use of that timing during reconnection? Or should the app simply leave AutoReconnect pending and let CoreBluetooth handle reception? WWDC22 reduced reconnection range WWDC22 session 10135 says: “If your device is on the edge of Bluetooth range and repeatedly disconnects while in Background BLE connection, the reconnection range will be reduced. This means only devices close to the Apple Watch will reconnect.” The session also says these limits are counted over a rolling 24-hour window and are reset when the user interacts with the app. I would particularly appreciate clarification of how this works in practice: What conditions cause a disconnect to count toward this policy? Does this policy apply while an app has an active HKWorkoutSession and continues executing in the background? Is the state maintained per peripheral, per app, or more globally? What exactly constitutes the user interaction that resets it? Does bringing an already-running workout app back to the foreground reset it, or does the app need to be relaunched? Is there any public API or diagnostic indication that reduced reconnection range is currently active? Is there any supported way to explicitly clear/reset that state? Connection parameters Does watchOS expose any supported mechanism for a CoreBluetooth central to influence parameters relevant to connection robustness, such as connection interval, supervision timeout, PHY, transmit power, or similar link parameters? Diagnosing CBError.connectionTimeout When CoreBluetooth reports CBError.connectionTimeout, is there any supported diagnostic method to determine whether the Watch stopped receiving the peripheral, the peripheral stopped receiving the Watch, or whether this should simply be treated as a link-layer timeout without attribution to either side? For context, this is not primarily a background-runtime problem. The active workout keeps the app running and the normal persistent BLE connection can operate flawlessly for many hours. I’m specifically trying to understand the best supported strategy for preserving and recovering the BLE link when RF conditions temporarily become marginal, especially with a peripheral that advertises very sparsely after a disconnect. DTS asked me to post this question here for review.
Replies
0
Boosts
0
Views
48
Activity
3d
Supported filesystem quota boundary for VZMacOSInstaller temporary writes
On Apple silicon with macOS 26.6.2 (25G83), I am preparing a small synthetic VM using Swift and public Virtualization.framework APIs. Before invoking VZMacOSInstaller, I need to establish a hard aggregate allocation bound covering its temporary extraction data and relevant helper caches, not just the supplied restore image, guest disk and auxiliary-storage URLs. The application-owned artifacts would be placed inside a fixed-size, capped filesystem. Unknown installer scratch remains part of the byte budget. Sampling free space or cancelling after a threshold is crossed is not a substitute for filesystem enforcement in this design. No installer has been started for this trial; this is an API-design question, not a reproduced installation failure. Is there a supported mechanism to select or constrain the filesystem for all VZMacOSInstaller and relevant helper temporary writes? In particular, is there a documented binding between a caller's temporary directory and independently managed installer-service storage, or another supported aggregate quota design? If the public API cannot provide this guarantee, an explicit statement of that limitation would help. I am not seeking private parameters, managed-container relocation, disabled system protections, or undocumented sandbox overrides.
Replies
1
Boosts
0
Views
164
Activity
3d
Can guestDidStopVirtualMachine distinguish clean Linux shutdown from panic/watchdog/emergency stop?
I’m using Virtualization.framework on Apple silicon with a Linux guest (VZGenericPlatformConfiguration + VZLinuxBootLoader). The VM is intentionally minimal: 2 vCPUs, 2 GiB RAM 1 virtio entropy device 2 virtio block devices (base read-only, scratch read-write) 1 virtio console with 2 ports, both isConsole = false no serial, network, sharing, socket, USB, audio, graphics, keyboard, pointing, balloon, or custom virtio devices no EFI variable store nested virtualization disabled On the normal success path the host does not call requestStop(). A destructive host stop is tracked separately and treated as failure. I need a supported way for the host to distinguish: a clean Linux guest shutdown intentionally issued by the guest after its application protocol and cleanup have completed, from an abnormal or independent shutdown path such as kernel panic, watchdog, thermal / hardware-protection shutdown, emergency shutdown, or another kernel/platform-triggered stop. guestDidStopVirtualMachine tells me that the guest stopped, but I cannot find a public contract that says which Linux/kernel/platform histories can produce that callback, nor a public shutdown reason/initiator value. My specific questions are: For VZGenericPlatformConfiguration + VZLinuxBootLoader, what is the documented complete guest-visible shutdown/reset event surface, including implicit platform events not represented by explicitly configured device arrays? What Linux-facing mechanism does VZVirtualMachine.requestStop() use in this configuration? Can guestDidStopVirtualMachine also be emitted after panic, watchdog, thermal/hardware-protection shutdown, emergency shutdown, or another guest-kernel/platform shutdown source? Are those abnormal cases guaranteed to arrive through virtualMachine(_:didStopWithError:) instead? If guestDidStopVirtualMachine can represent multiple terminal histories, is there any supported public API or documented guarantee that lets the host distinguish a clean guest system-off from the abnormal/platform-triggered cases? If not, is it correct to treat this distinction as unspecified by the public Virtualization.framework contract? I do not need private implementation details. A public/supported contract describing which terminal histories can produce each delegate callback would be enough. This matters because the host is fail-closed: it must accept PASS only after an application-level success condition and a clean guest shutdown. A successful runtime observation alone is not enough for the qualification. Environment: Apple silicon / arm64 macOS 26.6.2 (25G83) public Virtualization.framework APIs
Replies
2
Boosts
0
Views
188
Activity
3d
Why are symbolic followed when installating a .pkg payload?
In macOS Tahoe 26.7 or Sequoia 15.7.5 (and probably other prior versions), when you install a .pkg, symlinks are followed: i.e. if your payload install a file to /Users/Shared/my-folder and, on the target volume, the /Users/Shared/my-folder item is a symbolic link to /Users/Shared/actual-folder, the file will be installed inside /Users/Shared/actual-folder. It used to be possible to tell the installation framework/mechanism not to follow symbolic links by using the followSymLinks attribute in the raw package PackageInfo file. And in this case, the symbolic link would be replaced by a real directory and the file would be installed where it was supposed to be installed. This attribute is apparently not taken into account anymore by the framework/mechanism. [Q] Is this on purpose or is it a bug (in shove for instance)? If it is on purpose, why was it considered a good idea to always follow symbolic links considering the security issues this can create?
Replies
3
Boosts
0
Views
527
Activity
3d
macOS grants half the connection-event airtime that iOS does, for the same accessory
We make a BLE peripheral that streams continuously. It's been running against Android, Windows, macOS and iOS for years. Android and Windows sit at ~1000 kbps and stay there — many host devices, many OS versions, no per-host tuning. macOS and iOS give us about half that. We've sniffed the BLE link using a Bluetooth sniffer to find out where it goes. Same board, same firmware, every session. Read off the air trace, not from host APIs: 2M PHY both directions (LL_PHY_UPDATE_IND 0x02 / 0x02) DLE max_tx_octets = 251 ATT MTU 247 15.00 ms interval, peripheral latency 0 no encryption no other BLE or BT Classic connections active during the session (all other devices removed and forgotten) WiFi turned off for around half of the sessions, didn't seem to make any difference Peripheral airtime per connection event: central airtime/event duty @ 15 ms throughput Android 11.14 ms 74% 995 kbps, sustained Windows ≥10.70 ms ≥71% ~1000 kbps, sustained macOS 6.96 ms 46% 561 kbps iOS 6.96 ms typical 46% ~560–600 kbps macOS comes out median 6.96, p90 6.96, max 7.09 across a whole session. Same number every time. iOS normally sits in the same place, with occasional brief excursions up to Android-like performance before dropping back down. Those excursions are worth describing, because they're the interesting part. In a handful of sessions out of many, iOS runs at 12.53 ms, 84% duty, ~1030 kbps. It never holds. It drops back inside 150 ms, with no renegotiation, no parameter change and no channel-map change anywhere in the trace. Sometimes it parks at 8.35 ms for ten seconds before moving again. This isn't us saying iOS is fine in practice — it clearly isn't, we can't ship against it. The point is that the radio and the stack demonstrably can fill a 12.53 ms event when they're allowed to, so whatever is holding them to 6.96 ms isn't a hardware ceiling. "It's a factor of ability" doesn't fit. This has been asked before and answered. In thread 774487, asked directly whether iOS limits packets per connection event to 4: "there is no 'limiting' going on as it is commonly understood ... We find that 4 is a more commonly true number than 6 or more some chipsets claim." In thread 770717, to a developer on iOS 18.2 running the same parameters we are: "iOS does not 'limit' the number of writes. It is just a factor of ability." Both answers need the accessory to be the variable. Ours isn't — same board, same firmware, minutes apart, and two non-Apple hosts take it to 1000 kbps and hold it indefinitely. The only thing that changes is which OS is acting as central. We don't think this can be explained by chipset capability when the chipset is the one thing held constant. It's airtime, not packet count. The "4 packets per connection event" number people quote here is the wrong unit, and we think that's why these threads go nowhere. Within one regime, as PDUs per event go up, PDU size goes down and the airtime doesn't move: iOS 9 PDUs @ 250.4 B -> 12.51 ms 10 PDUs @ 211.1 B -> 12.32 ms 11 PDUs @ 186.4 B -> 12.47 ms macOS 5 PDUs @ 239.4 B -> 6.73 ms 6 PDUs @ 178.1 B -> 6.60 ms Nothing is counting packets. The event closes on a clock. Count and airtime were the same measurement back when everything was 1M PHY and 27-byte PDUs — with 2M and DLE they aren't, and quoting a packet count now hides the mechanism instead of describing it. The peripheral isn't the limiter. The MD bit was set on the peripheral's last PDU in 2147 of 2148 connection events. It always had more data queued, and the central closed the event anyway. This isn't a new report. The same mechanism has been described here before. Thread 133092 (2019) reports macOS closing the connection event while the peripheral still has MD set — exactly what we measure. Thread 713349 reports "about 5 response packets per connection event," which is the same budget: 6.96 ms is 5 full-size PDUs. Thread 6025 reports a drop from 7 packets to 3. None of those received a reply. We're not raising them to relitigate old threads. The point is that three independent reports arriving at the same number across several years, on different accessories, points at a property of the scheduler rather than of anyone's hardware. On iOS, this looks like it changed in iOS 18. macOS has apparently behaved this way for years, going by the threads above. On iOS it's recent. We have video and screen recordings of this same peripheral tested on iOS 17, documented at the time as running consistently at around 1000 kbps. The behaviour described here started appearing when we moved to iOS 18. The firmware and the negotiated parameters are the same now as they were then, which points at a change in radio scheduling rather than anything on our side. What we're asking: Is the per-event airtime budget deliberate? ADG §55.6 and QA1931 cover interval, latency and timeout only. Neither mentions connection event length. Why do macOS and iOS give roughly half what Android and Windows give for the same accessory, and why can iOS reach 12.53 ms without staying there? Did anything change in iOS 18 around connection event scheduling? Is there anything we can do from the accessory or app side? We're already at 2M PHY, DLE 251, MTU 247 and the 15 ms floor. If the answer is "design for a floor, not a peak" — what's the floor? Right now we plan for ~560 kbps on Apple and roughly double that everywhere else, and that decides what we can ship, and whether we can count on Apple devices as a reliable platform for our product. Captures, recordings and analysis available if they're useful.
Replies
2
Boosts
0
Views
469
Activity
3d
Possible deadlock between es_mute_process_events and AUTH response on the same es_client_t
We occasionally observe es_mute_process_events() called on an es_client_t while an AUTH event delivered by the same client is still outstanding. In the problematic state, es_mute_process_events() stops returning inside IOConnectCallStructMethod. Subsequent calls to es_respond_flags_result() and a fallback es_respond_auth_result() on the same es_client_t also block in IOConnectCallStructMethod, eventually causing the AUTH deadline to be missed. We would like to clarify the concurrency semantics of these APIs: Is it supported to call es_mute_process_events() before responding to an outstanding AUTH event delivered by the same es_client_t? Can es_mute_process_events() wait for in-flight/outstanding AUTH processing? Are mute operations and es_respond_*() calls serialized internally for a single es_client_t? Can an in-progress mute operation prevent a concurrent es_respond_*() call from completing? Is the recommended pattern to respond to the AUTH message first and update mute state asynchronously afterward?
Replies
3
Boosts
0
Views
428
Activity
4d