macOS (standalone) 1.86.4 network extension goes braindead sometimes

[luckman212]

What is the issue?

Platform

• macOS 15.6 (24G84)
• Mac Mini M4
• Tailscale 1.86.4 (standalone / networkextension)
• I'm located in NYC and am typically connected to the nyc derp

Bug

Today my Mac was having a very hard time staying connected to the Tailnet. I noticed connectivity was very intermittent. When I checked the VPN settings panel in System Settings, I saw something very strange. The Tailscale VPN item was toggled "off" but I saw very quick flashes of blue light where the switch was trying to turn itself on. I grabbed a screen recording because I figured it would be hard to explain:

new1.mp4

Got this dialog when I tried to connect using the Tailscale GUI app:

The tailscale CLI was also timing out, reporting errors like BadResponse, CLIError, or Unavailable after about a 10-second pause to commands like tailscale status or tailscale up.

I have a 2 hour macOS logarchive filtered for the Tailscale predicates. If it helps debug, I can send it privately (sample below...)

Steps to reproduce

?

Are there any recent changes that introduced the issue?

?

OS

macOS

OS version

15.6

Tailscale version

1.86.2

Other software

pfSense router

Bug report

BUG-ee42d157ab8ce6bbf56dd6cc4f79b83b4310b9571f2271bfb35c7294a331b9da-20250802231950Z-8f176f86c2508e53

[luckman212]

Same thing happened on my M4 MacBook Air today

This time, toggling the GUI "off" and then "on" restored it, however.

[luckman212]

Got a new macOS notification that I hadn't seen before, I believe might be related to this issue

I had definitely approved the extension...

[luckman212]

While we await any response from the Tailscale devs, I found that force-quitting the network extension allows me to at least reconnect to my tailnet without a full reboot:

sudo pkill -x io.tailscale.ipn.macsys.network-extension

[nickoneill]

You're not going to have a good time with this many VPN configurations installed, can you try the same test without the other configs and see if the behavior reproduces?

[luckman212]

@nickoneill Thanks for the reply, but don't understand your comment really. Those are all inactive VPN configs. I use them very rarely, and when I do, they are used one at a time.

[luckman212]

Just noting that I switched to the userspace CLI implementation of Wireguard, and deleted the Wireguard macOS app entirely. It's abandonware anyway, hasn't seen an update in 3+ years and currently has a growing list of unaddressed bugs. So good riddance there.

Here's how my "VPN" pane looks now—just Tailscale:

FWIW, this has had no positive effect on #15389 which I still suffer badly from. I am running "unstable" version 1.89.185 @nickoneill

[luckman212]

Closing this particular issue as I have not had it for a while and versions of macOS and Tailscale have both bumped significantly.