I dug into XNU code, found the SENDING_NOTIFICATION__THIS_PROCESS_HAS_TOO_MANY_MACH_PORTS function in task.c, the code in this func generate the errcode seems to fit the log I mentioned before. I gotta clarify that I use dispatch_async to dispatch es_msg_handling to a concurrent queue. I don't know much about xpc's underlying mechanism, it seems that too many threads use xpc to send too much data will end up generating too many mach ports, in another situation, I keep the amount of log to be send, but threads will leave the sending data operation to a serial queue. eventually, system extension exit because of OS_REASON_JETSAM. so it seems OK to send data through XPC in single thread no matter how much the data is. or at least, it may not happen before JETSAM [quote='789091022, DTS Engineer, /thread/756202?answerId=789091022#789091022'] What you're describing means that every call to "write" across the entire monitored system will end up generating a mach message to a single mach port being processed by a single thread. [/quote]

[quote='795713022, DTS Engineer, /thread/759663?answerId=795713022#795713022'] Presuming that your goal is to install the sysex via the System Extensions framework [/quote] thank you for reply, eskimo! is there another way to install and uninstall system extension?

solved, got more error info with "log stream".

I get the reason, it's through Apple Event.