macOS 26 (Tahoe) — Kaspersky VPN Secure Connection freezes on launch (“com.kaspersky.ksec.bl.resolver” deadlock)

[m_kurzdym]

Hello everyone,

I’d like to report a reproducible issue with Kaspersky VPN Secure Connection (App Store version 3.5.0, build 30500.79.14444486) on macOS 26.0.1 (Tahoe).
The application freezes immediately upon launch and remains unresponsive until forcibly terminated.

---

Observed behaviour

After launching, the ksec_app process becomes stuck in a waiting state, as seen in macOS diagnostic reports:

 

Quote

blocked by turnstile waiting for launchd [1] send port name "com.kaspersky.ksec.bl.resolver"

 

This means the app is attempting to connect to a non-existent or unresponsive XPC helper service (com.kaspersky.ksec.bl.resolver), resulting in a permanent hang.

---

Technical background

• The App Store build registers an internal XPC service com.kaspersky.ksec.bl.resolver.

• On macOS 26 (Tahoe), Apple introduced persistent sandbox XPC restoration.
  Even if the related container or plist is deleted, launchd automatically restores the entry at next boot.

• Since the restored service no longer responds, the VPN UI (ksec_app) hangs on the XPC handshake stage and never completes initialisation.

---

Workaround (confirmed functional)

1. Quit the app completely:

    

   Quote

   pkill ksec

    

2. Remove the stuck resolver:

    

   Quote

   launchctl remove com.kaspersky.ksec.bl.resolver

    

3. Delete the sandbox containers:

    

   Quote

   rm -rf ~/Library/Group\ Containers/*ksec* rm -rf ~/Library/Containers/com.kaspersky.ksec*

    

4. In Finder → Go → Go to Folder… → ~/Library/Containers/
   Delete the folder com.kaspersky.ksec.bl.resolver manually, then empty the Trash.

5. Relaunch the VPN.
   It starts and connects normally after that.

(Optional: to prevent macOS from recreating the broken resolver after reboot, create an empty dummy file /Library/LaunchDaemons/com.kaspersky.ksec.bl.resolver.plist with no permissions.)

---

Expected behaviour

VPN should initialise its XPC connection dynamically on launch, without relying on persistent system registration that may be invalidated by macOS sandbox changes.

---

Environment

Component	Version
macOS	26.0.1 (Tahoe, build 25A362)
Hardware	MacBook Pro 16,1 – Intel i9
VPN	3.5.0 (App Store build)
Distribution	Mac App Store
Reproducible	Always, after restart

---

Summary

This appears to be a compatibility issue between the App Store build and macOS 26’s updated XPC sandbox behaviour.
Manual cleanup and deregistration of com.kaspersky.ksec.bl.resolver restores normal functionality.
Please forward this to the Mac development team for verification and patching.

Best regards,
M. Kurzdym, PhD (UK)