Crash in macOS Content Filter System Extension

Hi,

One of our customers is seeing a crash in our Content Filter in our network system extension. We're kind of at a loss for the cause of this as only one specific person is running into this and we're not at all in the stacktrace, out of the hundreds of others deployed with our extension.

It would be greatly appreciated if we could have any help in diagnosing this issue. Attached is the crash report, and below is the crashing stacktrace. If this crash log is not sufficient, I have many more from the customer that I can attatch here.

{"app_name":"com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension","timestamp":"2024-12-04 06:59:54.00 -0800","app_version":"13.52.10995","slice_uuid":"7795354a-68b5-3d8a-8ab4-f2899b35a350","build_version":"1","platform":1,"bundleID":"com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension","share_with_app_devs":0,"is_first_party":1,"bug_type":"309","os_version":"macOS 15.1.1 (24B91)","roots_installed":0,"name":"com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension","incident_id":"27E91F6E-6570-4AAE-9E1D-854D6F24555A"}
{
  "uptime" : 1000,
  "procRole" : "Unspecified",
  "version" : 2,
  "userID" : 0,
  "deployVersion" : 210,
  "modelCode" : "MacBookPro17,1",
  "coalitionID" : 627,
  "osVersion" : {
    "train" : "macOS 15.1.1",
    "build" : "24B91",
    "releaseType" : "User"
  },
  "captureTime" : "2024-12-04 06:59:54.0629 -0800",
  "codeSigningMonitor" : 1,
  "incident" : "27E91F6E-6570-4AAE-9E1D-854D6F24555A",
  "pid" : 4807,
  "translated" : false,
  "cpuType" : "ARM-64",
  "roots_installed" : 0,
  "bug_type" : "309",
  "procLaunch" : "2024-12-04 06:59:50.1421 -0800",
  "procStartAbsTime" : 26101396315,
  "procExitAbsTime" : 26195479693,
  "procName" : "com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension",
  "procPath" : "\/Library\/SystemExtensions\/*\/com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension",
  "bundleInfo" : {"CFBundleShortVersionString":"13.52.10995","CFBundleVersion":"1","CFBundleIdentifier":"com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension"},
  "parentProc" : "launchd",
  "parentPid" : 1,
  "coalitionName" : "NetworkExtension.com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension.13.52.10995.1",
  "crashReporterKey" : "A9C601D6-9EA0-03BB-EB6B-17E5995DC0FE",
  "throttleTimeout" : 10,
  "codeSigningID" : "com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension",
  "codeSigningTeamID" : "LFYST47YD2",
  "codeSigningFlags" : 570503953,
  "codeSigningValidationCategory" : 6,
  "codeSigningTrustLevel" : 4294967295,
  "instructionByteStream" : {"beforePC":"fyMD1f17v6n9AwCRcuD\/l78DAJH9e8Go\/w9f1sADX9YQKYDSARAA1A==","atPC":"AwEAVH8jA9X9e7+p\/QMAkWfg\/5e\/AwCR\/XvBqP8PX9bAA1\/WcAqA0g=="},
  "bootSessionUUID" : "C32F9227-925F-412A-B2CF-94FAB2453448",
  "sip" : "enabled",
  "exception" : {"codes":"0x0000000000000000, 0x0000000000000000","rawCodes":[0,0],"type":"EXC_CRASH","signal":"SIGABRT"},
  "termination" : {"flags":0,"code":6,"namespace":"SIGNAL","indicator":"Abort trap: 6","byProc":"com.nnnnnnnnnnnnnnnnn.mmmmmmmmm","byPid":4807},
  "asi" : {"libsystem_c.dylib":["abort() called"]},
  "extMods" : {"caller":{"thread_create":0,"thread_set_state":0,"task_for_pid":0},"system":{"thread_create":0,"thread_set_state":0,"task_for_pid":0},"targeted":{"thread_create":0,"thread_set_state":0,"task_for_pid":0},"warnings":0},
  "lastExceptionBacktrace" : [{"imageOffset":983796,"symbol":"__exceptionPreprocess","symbolLocation":164,"imageIndex":9},{"imageOffset":109784,"symbol":"objc_exception_throw","symbolLocation":88,"imageIndex":8},{"imageOffset":29052,"symbol":"-[NSPathStore2 copy]","symbolLocation":0,"imageIndex":10},{"imageOffset":146648,"symbol":"-[NSString containsString:]","symbolLocation":56,"imageIndex":10},{"imageOffset":2504224,"imageIndex":0},{"imageOffset":2503508,"imageIndex":0},{"imageOffset":2500164,"imageIndex":0},{"imageOffset":58284,"imageIndex":0},{"imageOffset":393996,"symbol":"-[NEFilterDataSavedMessageHandler executeWithFlow:context:]","symbolLocation":80,"imageIndex":11},{"imageOffset":393852,"symbol":"-[NEFilterDataSavedMessageHandler enqueueWithFlow:context:]","symbolLocation":172,"imageIndex":11},{"imageOffset":399476,"symbol":"__92-[NEFilterDataExtensionProviderContext handleNewFlow:reply:controlSocket:completionHandler:]_block_invoke_2","symbolLocation":380,"imageIndex":11},{"imageOffset":10488,"symbol":"_dispatch_call_block_and_release","symbolLocation":32,"imageIndex":5},{"imageOffset":18008,"symbol":"_dispatch_client_callout","symbolLocation":20,"imageIndex":5},{"imageOffset":48224,"symbol":"_dispatch_lane_serial_drain","symbolLocation":744,"imageIndex":5},{"imageOffset":51100,"symbol":"_dispatch_lane_invoke","symbolLocation":432,"imageIndex":5},{"imageOffset":96232,"symbol":"_dispatch_root_queue_drain_deferred_wlh","symbolLocation":288,"imageIndex":5},{"imageOffset":94260,"symbol":"_dispatch_workloop_worker_thread","symbolLocation":540,"imageIndex":5},{"imageOffset":13272,"symbol":"_pthread_wqthread","symbolLocation":288,"imageIndex":2},{"imageOffset":8432,"symbol":"start_wqthread","symbolLocation":8,"imageIndex":2}],
  "faultingThread" : 4,
  "threads" : [{"id":44009,"frames":[{"imageOffset":8424,"symbol":"start_wqthread","symbolLocation":0,"imageIndex":2}],"threadState":{"x":[{"value":6133673984},{"value":6915},{"value":6133137408},{"value":0},{"value":409604},{"value":18446744073709551615},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":0},"cpsr":{"value":4096},"fp":{"value":0},"sp":{"value":6133673984},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6657941736},"far":{"value":0}}},{"id":44010,"name":"logging","threadState":{"x":[{"value":260},{"value":0},{"value":0},{"value":0},{"value":0},{"value":160},{"value":9},{"value":999999000},{"value":6134246968},{"value":0},{"value":0},{"value":2},{"value":2},{"value":0},{"value":0},{"value":0},{"value":305},{"value":8490293256},{"value":0},{"value":105553172890688},{"value":105553172890752},{"value":6134247648},{"value":999999000},{"value":9},{"value":0},{"value":1},{"value":256},{"value":105553172890824},{"value":12297829382473034411}],"flavor":"ARM_THREAD_STATE64","lr":{"value":6657964180},"cpsr":{"value":1610616832},"fp":{"value":6134247088},"sp":{"value":6134246944},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6657709516},"far":{"value":0}},"frames":[{"imageOffset":17868,"symbol":"__psynch_cvwait","symbolLocation":8,"imageIndex":4},{"imageOffset":30868,"symbol":"_pthread_cond_wait","symbolLocation":1204,"imageIndex":2},{"imageOffset":2476248,"imageIndex":0},{"imageOffset":2020408,"imageIndex":0},{"imageOffset":2059268,"imageIndex":0},{"imageOffset":29412,"symbol":"_pthread_start","symbolLocation":136,"imageIndex":2},{"imageOffset":8444,"symbol":"thread_start","symbolLocation":8,"imageIndex":2}]},{"id":44011,"frames":[{"imageOffset":34148,"symbol":"__sigsuspend_nocancel","symbolLocation":8,"imageIndex":4},{"imageOffset":96940,"symbol":"_dispatch_sigsuspend","symbolLocation":48,"imageIndex":5},{"imageOffset":96892,"symbol":"_dispatch_sig_thread","symbolLocation":60,"imageIndex":5}],"threadState":{"x":[{"value":4},{"value":0},{"value":0},{"value":6134820800},{"value":6134820928},{"value":419432703},{"value":0},{"value":0},{"value":6134820800},{"value":6134820800},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":410},{"value":8490295496},{"value":0},{"value":6656421264,"symbolLocation":0,"symbol":"_dispatch_sigsuspend.mask"},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":6656260780},"cpsr":{"value":536875008},"fp":{"value":6134820768},"sp":{"value":6134820752},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6657725796},"far":{"value":0}}},{"id":44012,"frames":[{"imageOffset":8424,"symbol":"start_wqthread","symbolLocation":0,"imageIndex":2}],"threadState":{"x":[{"value":6135394304},{"value":8967},{"value":6134857728},{"value":0},{"value":409604},{"value":18446744073709551615},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":0},"cpsr":{"value":4096},"fp":{"value":0},"sp":{"value":6135394304},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6657941736},"far":{"value":0}}},{"triggered":true,"id":44018,"threadState":{"x":[{"value":0},{"value":0},{"value":0},{"value":0},{"value":6657678875},{"value":6135965696},{"value":110},{"value":0},{"value":411027844994872581},{"value":411027841276036357},{"value":81},{"value":11},{"value":11},{"value":6662962842},{"value":2095104},{"value":2043},{"value":328},{"value":8490293328},{"value":0},{"value":6},{"value":14083},{"value":6135967968},{"value":276},{"value":6135967968},{"value":105553154132840},{"value":0},{"value":0},{"value":105553148857600},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":6657961840},"cpsr":{"value":1073745920},"fp":{"value":6135965552},"sp":{"value":6135965520},"esr":{"value":1442840704,"description":" Address size fault"},"pc":{"value":6657730048,"matchesCrashFrame":1},"far":{"value":0}},"queue":"NEFilterExtensionProviderContext queue","frames":[{"imageOffset":38400,"symbol":"__pthread_kill","symbolLocation":8,"imageIndex":4},{"imageOffset":28528,"symbol":"pthread_kill","symbolLocation":288,"imageIndex":2},{"imageOffset":497928,"symbol":"abort","symbolLocation":128,"imageIndex":6},{"imageOffset":78924,"symbol":"abort_message","symbolLocation":132,"imageIndex":7},{"imageOffset":6720,"symbol":"demangling_terminate_handler()","symbolLocation":348,"imageIndex":7},{"imageOffset":152548,"symbol":"_objc_terminate()","symbolLocation":156,"imageIndex":8},{"imageOffset":75536,"symbol":"std::__terminate(void (*)())","symbolLocation":16,"imageIndex":7},{"imageOffset":75444,"symbol":"std::terminate()","symbolLocation":108,"imageIndex":7},{"imageOffset":18028,"symbol":"_dispatch_client_callout","symbolLocation":40,"imageIndex":5},{"imageOffset":48224,"symbol":"_dispatch_lane_serial_drain","symbolLocation":744,"imageIndex":5},{"imageOffset":51100,"symbol":"_dispatch_lane_invoke","symbolLocation":432,"imageIndex":5},{"imageOffset":96232,"symbol":"_dispatch_root_queue_drain_deferred_wlh","symbolLocation":288,"imageIndex":5},{"imageOffset":94260,"symbol":"_dispatch_workloop_worker_thread","symbolLocation":540,"imageIndex":5},{"imageOffset":13272,"symbol":"_pthread_wqthread","symbolLocation":288,"imageIndex":2},{"imageOffset":8432,"symbol":"start_wqthread","symbolLocation":8,"imageIndex":2}]},{"id":44019,"frames":[{"imageOffset":8424,"symbol":"start_wqthread","symbolLocation":0,"imageIndex":2}],"threadState":{"x":[{"value":6136541184},{"value":0},{"value":6136004608},{"value":0},{"value":278530},{"value":18446744073709551615},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0},{"value":0}],"flavor":"ARM_THREAD_STATE64","lr":{"value":0},"cpsr":{"value":4096},"fp":{"value":0},"sp":{"value":6136541184},"esr":{"value":0,"description":" Address size fault"},"pc":{"value":6657941736},"far":{"value":0}}}],
  "usedImages" : [
  {
    "source" : "P",
    "arch" : "arm64",
    "base" : 4333764608,
    "CFBundleShortVersionString" : "13.52.10995",
    "CFBundleIdentifier" : "com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension",
    "size" : 6815744,
    "uuid" : "7795354a-68b5-3d8a-8ab4-f2899b35a350",
    "path" : "\/Library\/SystemExtensions\/*\/com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension",
    "name" : "com.nnnnnnnnnnnnnnnnn.mmmmmmmmmm.Extension",
    "CFBundleVersion" : "1"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 4376854528,
    "CFBundleShortVersionString" : "3.0",
    "CFBundleIdentifier" : "com.apple.security.csparser",
    "size" : 131072,
    "uuid" : "db365164-e7d4-3315-a4bf-a306666f29d7",
    "path" : "\/System\/Library\/Frameworks\/Security.framework\/Versions\/A\/PlugIns\/csparser.bundle\/Contents\/MacOS\/csparser",
    "name" : "csparser",
    "CFBundleVersion" : "61439.41.1.0.1"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6657933312,
    "size" : 53248,
    "uuid" : "3b8268be-4e02-3b4a-8b41-baed2bbaacff",
    "path" : "\/usr\/lib\/system\/libsystem_pthread.dylib",
    "name" : "libsystem_pthread.dylib"
  },
  {
    "size" : 0,
    "source" : "A",
    "base" : 0,
    "uuid" : "00000000-0000-0000-0000-000000000000"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6657691648,
    "size" : 241656,
    "uuid" : "9fea25a4-e8ca-3f3d-901c-a53ff2bc7217",
    "path" : "\/usr\/lib\/system\/libsystem_kernel.dylib",
    "name" : "libsystem_kernel.dylib"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6656163840,
    "size" : 290816,
    "uuid" : "9ea577db-73c2-39d8-9fc0-544fa595a142",
    "path" : "\/usr\/lib\/system\/libdispatch.dylib",
    "name" : "libdispatch.dylib"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6656466944,
    "size" : 532476,
    "uuid" : "96556ba0-9c34-326a-89f4-d3835de617ae",
    "path" : "\/usr\/lib\/system\/libsystem_c.dylib",
    "name" : "libsystem_c.dylib"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6657581056,
    "size" : 110592,
    "uuid" : "7de440df-bc7d-3ff3-905d-2e17a7629449",
    "path" : "\/usr\/lib\/libc++abi.dylib",
    "name" : "libc++abi.dylib"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6653919232,
    "size" : 335012,
    "uuid" : "219c0324-7a4f-338e-a395-3d023b289a7f",
    "path" : "\/usr\/lib\/libobjc.A.dylib",
    "name" : "libobjc.A.dylib"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6658392064,
    "CFBundleShortVersionString" : "6.9",
    "CFBundleIdentifier" : "com.apple.CoreFoundation",
    "size" : 5197824,
    "uuid" : "ae4610f8-7c5c-3484-858e-cae7457d206e",
    "path" : "\/System\/Library\/Frameworks\/CoreFoundation.framework\/Versions\/A\/CoreFoundation",
    "name" : "CoreFoundation",
    "CFBundleVersion" : "3107"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6677135360,
    "CFBundleShortVersionString" : "6.9",
    "CFBundleIdentifier" : "com.apple.Foundation",
    "size" : 14942208,
    "uuid" : "9b5ba00d-2241-342d-9949-f2f517d6989e",
    "path" : "\/System\/Library\/Frameworks\/Foundation.framework\/Versions\/C\/Foundation",
    "name" : "Foundation",
    "CFBundleVersion" : "3107"
  },
  {
    "source" : "P",
    "arch" : "arm64e",
    "base" : 6963171328,
    "CFBundleShortVersionString" : "1.0",
    "CFBundleIdentifier" : "com.apple.NetworkExtension",
    "size" : 2568192,
    "uuid" : "7dee7fb9-18ea-3b63-96ca-bec5a5313588",
    "path" : "\/System\/Library\/Frameworks\/NetworkExtension.framework\/Versions\/A\/NetworkExtension",
    "name" : "NetworkExtension",
    "CFBundleVersion" : "1"
  }
],
  "sharedCache" : {
  "base" : 6653444096,
  "size" : 4753735680,
  "uuid" : "f66bac4e-1e78-38af-b867-c1cf5daa0302"
},
  "vmSummary" : "ReadOnly portion of Libraries: Total=905.9M resident=0K(0%) swapped_out_or_unallocated=905.9M(100%)\nWritable regions: Total=956.5M written=402K(0%) resident=402K(0%) swapped_out=0K(0%) unallocated=956.1M(100%)\n\n                                VIRTUAL   REGION \nREGION TYPE                        SIZE    COUNT (non-coalesced) \n===========                     =======  ======= \nActivity Tracing                   256K        1 \nKernel Alloc Once                   32K        1 \nMALLOC                           952.2M       26 \nMALLOC guard page                   96K        6 \nSTACK GUARD                         96K        6 \nStack                             3296K        7 \nStack Guard                       64.0M        2 \n__AUTH                            1269K      224 \n__AUTH_CONST                      21.4M      376 \n__DATA                            5355K      359 \n__DATA_CONST                      14.1M      380 \n__DATA_DIRTY                       896K      114 \n__FONT_DATA                        2352        1 \n__LINKEDIT                       585.1M        3 \n__OBJC_RW                         2354K        1 \n__TEXT                           320.8M      393 \n__TPRO_CONST                       272K        2 \nmapped file                       31.6M        4 \nowned unmapped memory               32K        1 \npage table in kernel               402K        1 \nshared memory                      192K        4 \n===========                     =======  ======= \nTOTAL                              2.0G     1912 \n",
  "legacyInfo" : {
  "threadTriggered" : {
    "queue" : "NEFilterExtensionProviderContext queue"
  }
},
  "logWritingSignature" : "ea8a0cb9bfa7fef1674cfd2177d8a761254d0fb1"
}
Thread 4 Crashed::  Dispatch queue: NEFilterExtensionProviderContext queue
0   libsystem_kernel.dylib        	       0x18cd4e600 __pthread_kill + 8
1   libsystem_pthread.dylib       	       0x18cd86f70 pthread_kill + 288
2   libsystem_c.dylib             	       0x18cc93908 abort + 128
3   libc++abi.dylib               	       0x18cd3d44c abort_message + 132
4   libc++abi.dylib               	       0x18cd2ba40 demangling_terminate_handler() + 348
5   libobjc.A.dylib               	       0x18c9d13e4 _objc_terminate() + 156
6   libc++abi.dylib               	       0x18cd3c710 std::__terminate(void (*)()) + 16
7   libc++abi.dylib               	       0x18cd3c6b4 std::terminate() + 108
8   libdispatch.dylib             	       0x18cbd466c _dispatch_client_callout + 40
9   libdispatch.dylib             	       0x18cbdbc60 _dispatch_lane_serial_drain + 744
10  libdispatch.dylib             	       0x18cbdc79c _dispatch_lane_invoke + 432
11  libdispatch.dylib             	       0x18cbe77e8 _dispatch_root_queue_drain_deferred_wlh + 288
12  libdispatch.dylib             	       0x18cbe7034 _dispatch_workloop_worker_thread + 540
13  libsystem_pthread.dylib       	       0x18cd833d8 _pthread_wqthread + 288
14  libsystem_pthread.dylib       	       0x18cd820f0 start_wqthread + 8
Answered by DTS Engineer in 817061022

Looking through the stack crawl provided a couple of things stand out demangling_terminate_handler(), _dispatch_client_callout, and abort. There's also a call to abort_message so you might be able to find something in other logs. This looks like an unhandled exception in your code. demangling is something you usually see in C++ code. I'd look for unhandled C++ exceptions in your code (or libraries your code is calling).

Looking through the stack crawl provided a couple of things stand out demangling_terminate_handler(), _dispatch_client_callout, and abort. There's also a call to abort_message so you might be able to find something in other logs. This looks like an unhandled exception in your code. demangling is something you usually see in C++ code. I'd look for unhandled C++ exceptions in your code (or libraries your code is calling).

Written by DTS Engineer in 817061022
I'd look for unhandled C++ exceptions in your code (or libraries your code is calling).

Exactly.

This crash report indicates that your process crashed due to an unhandled language exception. Normally that’d result in a Last Exception Backtrace section in the crash report. However, if the exception was thrown by C++ code, that’s not generated [1].

Unfortunately that makes it hard to debug. The fact that this is on the NEFilterExtensionProviderContext queue suggests that the exception is being thrown by code in your NEFilterProvider subclass, most likely in one of the methods, like -handleNewFlow:, that you implement by overriding. I recommend that you add a top-level trycatch block to each of those methods to catch the exception before it ‘escapes’ your code.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] A source of ongoing annoyance. See the various posts on this thread.

Crash in macOS Content Filter System Extension
 
 
Q