Hi, Yes, thought that may be easier to follow back on from your end. I have a variety of related feedback cases please see below @DTS Engineer : FB8650868 FB9111779 FB8528236 I believe these do get translated to radar cases but I haven't been provided with those.

Hi, Yes i have various pre-existing feedback regarding this behaviour dating back to its inception iOS 13. Just to add GSS is quite awesome considering it's time. The layering it provides to mesh Apple's bespoke security implementations of the keychain with opensource libraries like heimdal is awesome. My gripes with GSS more exist with AppSSO and other mechanisms which sit away from it but interact with it creating unique and in some cases unusual limitations. (like the choice to only handle kerberos on 401 response instead of also 407). Please post your bug number, just for the record. If you're up for a bit of history the long standing case we have raised about this is 100926273318. @DTS Engineer

I have come across a way to force the nested functions to use proxy. I suspected that the network handler for the nested functions is incorrectly interpreting a 403 forbidden response from the proxy as the PAC file being unreachable. By setting "ProxyPACFallbackAllowed" to False has prevented the nested requests from failing to use the proxy_resolver. Whilst we can set this in a profile for some managed wifi networks users that connect to networks without a profile will not have control over this setting.