Supported memory-limit increase for an iOS Enhanced Security helper extension

We’re using an Enhanced Security helper extension with AppExtensionProcess and XPCSession to isolate native zero-knowledge proof generation from wallet and signing code.

On an iPhone 15 Pro running iOS 26.6.2 (23G90), the helper terminates with:

EXC_RESOURCE
RESOURCE_TYPE_MEMORY: high watermark memory limit exceeded
(limit=35 MB)

Terminated due to memory issue

Our current prover requires substantially more memory: its public proving key is approximately 402 MiB, and its witness workspace alone is approximately 69 MiB. The same proof engine has completed successfully in a standalone iOS app process. The helper currently processes only synthetic test inputs.

We want to preserve the helper’s sandbox and Enhanced Security protections and use a configuration supported for App Store distribution.

  1. Is there a supported way to increase the memory limit for this specific helper extension type?
  2. Does com.apple.developer.kernel.increased-memory-limit apply to Enhanced Security helper extensions? If so, what provisioning, target configuration, and device/OS requirements apply?
Answered by DTS Engineer in 912362022
Written by heatht in 912225022

Xcode’s cached capability metadata lists only com.apple.product-type.application for this entitlement.

Yeah, I figured you might bump into something like that.

IMO it’s not worth arguing with Xcode here. If it’s gone out of its way to block this, that’s a clear signal that it’s not gonna work.

And, yeah, it was always a long shot. I’ve previously dug into this — for the purposes of updating this thread — and my understanding from there is that the system’s memory limit enforcement for extensions is very different than that for apps.

Written by heatht in 912225022

should I file a bug for this restriction?

Yes. See Bug Reporting: How and Why? for general advice on that front. And please post your bug number, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I don’t think you’ll find a way around this limit. However, I think it’s worth trying com.apple.developer.kernel.increased-memory-limit before giving up on this completely. You’ll need to add it to the appex, not the app.

And hey, it seems like we’ve fixed all the bugs that made it hard to use (-:

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Thanks Quinn. I added com.apple.developer.kernel.increased-memory-limit = true to the Enhanced Security .appex only, keeping its existing hardening entitlements unchanged.

Automatic signing in Xcode 27.1 (27A9275), using my paid developer team, fails with:

“Entitlement com.apple.developer.kernel.increased-memory-limit not found and could not be included in profile. This likely is not a valid entitlement and should be removed from your entitlements file.”

Xcode’s cached capability metadata lists only com.apple.product-type.application for this entitlement.

Is there a supported way to provision it for an Enhanced Security extension, perhaps through manual provisioning, or should I file a bug for this restriction?

Written by heatht in 912225022

Xcode’s cached capability metadata lists only com.apple.product-type.application for this entitlement.

Yeah, I figured you might bump into something like that.

IMO it’s not worth arguing with Xcode here. If it’s gone out of its way to block this, that’s a clear signal that it’s not gonna work.

And, yeah, it was always a long shot. I’ve previously dug into this — for the purposes of updating this thread — and my understanding from there is that the system’s memory limit enforcement for extensions is very different than that for apps.

Written by heatht in 912225022

should I file a bug for this restriction?

Yes. See Bug Reporting: How and Why? for general advice on that front. And please post your bug number, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Understood, unfortunate but thanks for the help.
I've filed a bug for the original problem. the bug number is:
FB25356254