Number of Network Extension Limitations of future macOS

I did see some discussions suggesting that Apple might restrict this to 5 extensions in macOS Tahoe.

Where did you see those discussions?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@DTS Engineer I requested the customer to share a link or any source, but haven’t received a response yet.

@DTS Engineer If there is already 4 Filter extension enabled, 5th one fails and below is the log stream output.

Exceeded Content Filter limit, TESTFilter superceded

2026-03-08 11:44:17.270577+0530 0x198d3    Default     0x0                  466    0    nehelper: (NetworkExtension) [com.apple.networkextension:] +[NEConfigurationManager configuration:overlapsWithOtherConfiguration:sameTypeCount:perAppCount:]: Exceeded Content Filter limit, TESTFilter superceded

I have tested this on macOS 26.3.1

Is this documented somewhere?

Thanks for posting that log entry. Using that I was able to quickly locate the code that enforces this restriction. It turns out that your analysis is spot on. The content filter machinery is generally limited to 8 filters [1] and on macOS this is divided evenly between the two filter grades

Is this documented somewhere?

Oh, hey, wouldya look at that, it’s actually documented on this page within the Apple Platform Deployment guide. (I really need to spend an afternoon reading that doc thoroughly.)

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] This is visible as CFIL_MAX_FILTER_COUNT in the Darwin open source.

WARNING As always, stuff you find in Darwin is considered an implementation detail rather than an API.