macOS Tahoe 26: DFS namespace subfolders return "No route to host" while direct SMB connections work

Environment

• macOS Tahoe 26.2 (Build 25C56)
• Also tested with macOS 26.3 Developer Beta - same issue
• Windows Server 2022 DFS namespace
• Connection via Tailscale VPN (but also tested with direct network connection)

Problem Description

When connecting to a Windows Server 2022 DFS namespace from macOS Tahoe, the root namespace connects successfully, but all subfolders appear empty and return either:

• "No route to host"
• "Authentication error" (alternates inconsistently)

Steps to Reproduce

1. Set up a Windows Server 2022 DFS namespace (e.g., \\domain.com\fs)
2. Add DFS folder targets pointing to file servers (e.g., \\fs02\share, \\fs03\share)
3. From macOS Tahoe, connect via Finder: smb://domain.com/fs
4. Root namespace mounts successfully
5. Issue: Subfolders show as empty or return "No route to host" when accessed

What Works

• Direct SMB connections to individual file servers work perfectly:
  • smb://10.118.0.26/sharename ✓
  • smb://fs02.domain.com/sharename ✓
• Same DFS namespace works from Windows clients
• Same DFS namespace worked from macOS Sonoma 14.4+

What Doesn't Work

• DFS referrals from macOS Tahoe 26.x to any DFS folder target
• The issue persists regardless of:
  • Kerberos vs NTLM authentication
  • SMB signing enabled/disabled on servers
  • Various /etc/nsmb.conf configurations
  • DNS resolution (tested with IPs and FQDNs)

Historical Context

A similar DFS referral bug existed in macOS Sonoma 14.0 and was fixed in 14.1. This appears to be a regression in macOS Tahoe 26.

Request

Please investigate the DFS referral handling in macOS Tahoe. The fact that direct SMB connections work while DFS referrals fail suggests an issue specifically in the DFS referral processing code.

Feedback Assistant report will be filed separately.