macOS 27 Beta: Unexpected network behavior with minimal NEFilterDataProvider implementation

Hi,

We are currently testing our Network Extension based solution on macOS 27 Beta and have observed some unexpected networking behavior.

We would like to know whether other developers have encountered similar issues, or whether there are any known changes in macOS 27 Beta that may affect NEFilterDataProvider.

Environment

• macOS 27 Beta (tested on multiple Beta versions)
• System Extension
• Network Extension
• NEFilterDataProvider (Content Filter)
• Xcode Beta

Current Implementation

Our product uses NEFilterDataProvider for network traffic filtering.

To eliminate the possibility that our filtering logic is causing the issue, we created a minimal implementation.

The current provider behavior:

• Only handles TCP 80/443 flows
• Does not inspect payload content
• Does not perform URL filtering
• Does not perform domain matching
• Does not apply any block rules
• Does not modify network traffic
• All flows are immediately allowed

Example:

handleNewFlow()
        |
        |
return .allow()

The issue can still be reproduced when all flows are returned with .allow().

The Network Extension is only performing basic flow handling without any filtering decisions.

Observed Behavior

On macOS 27 Beta, we can still reproduce networking issues with this minimal implementation.

Observed symptoms include:

• Intermittent network connectivity issues
• DNS requests timing out or failing
• Some applications losing network access
• Chrome / Chromium-based applications are affected more frequently
• Safari sometimes continues working normally
• Disabling the Network Extension usually restores network connectivity
• Restarting or reloading the provider may require a significant amount of time before networking fully recovers

The issue appears to be independent of filtering decisions, because:

• No traffic is blocked
• No complex policy evaluation is performed
• No packet modification is performed
• All flows are allowed

Possible Areas

Based on our investigation, we suspect this may be related to changes in:

• NEFilterDataProvider lifecycle handling
• Interaction between Network Extension and the system networking stack
• Network recovery behavior after provider restart/reload
• Possible changes in networking components such as NECP, networkd, or DNS handling

Questions

1. Has anyone observed similar behavior with NEFilterDataProvider on macOS 27 Beta?

2. Are there any known compatibility considerations for Network Extension or Content Filter providers on macOS 27 Beta?

3. Have there been any changes to Network Extension lifecycle management or networking behavior that developers should be aware of?

4. Are there recommended debugging steps or diagnostic information that would help investigate this issue?

We can provide additional information if needed:

• sysdiagnose
• Console logs
• Network Extension logs
• Sample project
• Feedback Assistant ID

Thank you.