I wonder if anybody has encountered the same issue using TransparentProxyProvider to intercept all outgoing connections.

Once in a while (probably like once a week on each machine) I see these lines being printed in the unified log:

0xda0a7e  Error    0x0         0   0  kernel: (3188774830): mbuf_split failed: 12
0xda0a7e  Error    0x0         11825 0  com.dev.networkextension: (libnetworkextension.dylib) [com.apple.networkextension:] (0): data: write error: Cannot allocate memory
0xda0a7e  Default   0x0         11825 0  com.dev.networkextension: (libnetworkextension.dylib) [com.apple.networkextension:] (0): Aborting the director

Once this happens, the proxy stops receiving the handleNewFlow callbacks and all existing connections are invalidated – flow completion handlers return with flow not connected error.

I have identified that mbuf_split failed: 12 actually happens at:
https://opensource.apple.com/source/xnu/xnu-3248.20.55/bsd/netinet/flow_divert.c
in flow_divert_send_app_data() function.

However, due to the fact that libnetworkextension.dylib is non open source, I am unable to fully link it to the network extension.

It looks like there is some kind of allocation error in the kernel when trying to split the memory buffer.

I wonder if anybody else have encountered the same issue ?

If so, maybe you know what kernel tries to achieve here, why it fails and if I can avoid this problematic flow of events ?

Thanks !