ES_EVENT_TYPE_AUTH_OPEN hangs OS

I'm using 0x7fffffff and 0x0(which I found in other people's project, Apple doesn't give this document) as authorized_flags value for es_respond_flags_result. It works perfectly with SIP disabled. But when I test this in user env(SIP on, APP signed&notarized, grant system extension full disk access), the OS hangs. I'm pretty sure it's ES_EVENT_TYPE_AUTH_OPEN caused this problem, because once I remove this event from es_subscribe, my APP&system extension works perfectly in user env. Does anyone know to slove this problem? Or did I use the wrong authorized_flags value?

Many thanks!