I threw in the towel and disabled SIP. After enabling systemextensionsctl developer on and adding a scheme that elides copying to /Applications/SysExtDev, I can confirm that everything works as expected, so long as I remove the system extension between runs. There must be some funky interaction between SIP and system extensions (and perhaps loading from /Applications) that I was getting caught in. For now I'll just keep developing with SIP disabled, but I'd love to make sure this issue sees the right eyes because it would be really nice to not have to disable SIP. Would it be appropriate to file this as a feedback?
Topic:
App & System Services
SubTopic:
Networking
Tags: