I have an Electron Application which is hosting Endpoint Security System Extension. Usually I'm uninstalling it by deleting host application from /Applications/ folder. However, after updating multiple of my machines to Sonoma 15.3.2, this uninstallation flow doesn't work anymore. When I delete host app, it shows promt (approximately) "This application is hosting SysEx which will be removed..." After that, application is moved to .trash, however System Extension remains active and visible in System Settings. Host application name is changed to file name (Some Application -> Some Applciation.app) and this entry has no icon for Host App. I would appreciate any assistance on how to fix that or maybe create a bug report.

I have a launch daemon that's using the Endpoint Security framework which also is causing high memory usage (in Activity Monitor memory column shows for example 2GB and Real Memory 11MB) when building a big project in Xcode. Is it some kind of memory caching by the system? leaks -forkCorpse seems to not show any leaks. How can I attach with heap or Instruments without the process being killed with "ENDPOINTSECURITY, Code 2 EndpointSecurity client terminated because it failed to respond to a message before its deadline"?

I am using es_new_client and es_subscribe in SystemExtension and EndpointSecurity. I tested it on M3, and it is working. It also works on M1 versions 12, 13, and 14. Additionally, ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD is functioning correctly. However, there is a bug on M1 Big Sur where es_new_client's es_handler_block_t cannot receive ES_EVENT_TYPE_NOTIFY_KEXTLOAD. The tested command is: sudo kextload /System/Library/Extensions/msdosfs.kext sudo kextload /System/Library/Extensions/*.kext Is this intended behavior or a bug? Are there any plans to fix it?