Hello! I am hoping a DTS engineer or someone who knows the Capability Requests portal can help, because I am stuck between a written support confirmation and what the portal actually shows. Background. We are building a native macOS iSCSI initiator for SOHO and home NAS use, developed over close to two years. A userspace daemon runs the iSCSI protocol and a DriverKit system extension presents the remote LUN as a block device. The code is essentially complete. Only the DriverKit extension cannot be signed, loaded and validated without the entitlement. We submitted request 32PC8MGU57 for two entitlements: com.apple.developer.driverkit.family.block-storage-device for the extension com.aviontex.iscsi.AviontexISCSI.AviontexInitiator com.apple.developer.driverkit.userclient-access for the app com.aviontex.iscsi.AviontexISCSI, scoped to the extension bundle id The problem. On June 25 Developer Support confirmed in writing that both entitlements were granted. The portal does not match that: Block Storage Device: No Requests: on both App IDs UserClient Access: Assigned: on the app SCSI Controller: Submitted: on the app So the one entitlement we actually need, Block Storage Device, shows as never requested, even though request 32PC8MGU57 covered it and support confirmed the grant. The case was escalated to the senior team on July 2 (case 102922935570). Follow-up emails since then have not received a response. Why Block Storage Device specifically Our initiator has no PCI or Thunderbolt bus and no DMA path, so SCSIControllerDriverKit does not fit. This is confirmed by DTS in thread 776020, where Kevin Elliott explains that SCSIControllerDriverKit passes data through fBufferIOVMAddr as a physical address with no mechanism to convert it into a VM address the dext can access. He also notes it cannot be used with any bus other than PCI or Thunderbolt. Block Storage Device is therefore the family we need. My questions: Am I reading the portal correctly: Block Storage Device not requested, UserClient Access assigned, SCSI Controller submitted? From here, what is the correct way to get Block Storage Device onto these two App IDs, with both the Development and the Distribution grant, since our public beta depends on Distribution? Should I submit a new request through the Capability Requests tab or does the escalated case handle it? Is there any way to get visibility on the escalated case, since email follow-ups are not being answered? A full technical justification is prepared and we are happy to share the source code. Any guidance would be appreciated. Thank you.

Hi Kevin, I need to revise my earlier assessment completely. I seriously underestimated what App Sandbox can do. My teammate Micha had already proven it. I am now officially outnumbered ;) I guess I'm getting too old for this shit. The only thing that doesn't work yet is formatting LUNs from within the app. It would be great to have this supported as well, just like with USB devices. For now we can live with it. We simply haven't found a suitable API for doing this inside the sandbox. If there is one, please let me know. Honestly, "Sandbox" is a serious understatement for what you built there. "SandOS" would fit much better ;) One example: we have now decoupled our processes with the sandbox. GUI and DEXT run separately. The GUI crashes? iSCSI keeps running. The DEXT crashes? It is back so fast that iSCSI doesn't even notice (!) Both crash? The DEXT recovers. iSCSI holds. The GUI stays closed. Once it is reopened, everything looks as if nothing had happened. Whatever happens in our stack, the storage connection stays intact as long as the OS is running. That is really incredible work by your teams. It opens up completely different possibilities for us. Thank you for challenging my assumption. Best regards, Torsten