We are having serious issues with the latest Sophos update (10.0.3), with regards to connecting to AFP servers.
What we observed so far:
machines running macOS 11.2.1 with the latest Sophos update, trying to connect to any AFP share, yields almost exclusively failed results. Connections do not seem to go through, and in the macOS Console, we have crash reports for the 'com.sophos.endpoint.networkextension' processes, furthermore, this causes most of my connections to other services (like logged in SSH sessions) to drop their connection as well.
Sometimes I did get access to the share, which then asks for me password, after which the connections fails again. I can get access if I rapidly go through the connections + password entering steps after a failed attempt, likely before the networkextension process is up and running again.
At first glance it looks to be the same issue as https://community.sophos.com/intercept-x-endpoint/big-sur-eap/f/discussions/125960/10-0-3-sophos-network-extension-process-using-150-cpu, however, my CPU usage does rise from time to time, but I haven't seen it get that high.
Uninstalling Sophos Endpoint allows me to connect to any of the previously failing first try, without any failures whatsoever. Reinstalling Sophos again makes me lose connection to our AFP capable shares. SMB shares on the same machine do not seem to have the same issue, neither do FTP connections.
As stated before, this was observed on 2 different machines (so far), both running macOS 11.2.1 and Sophos 10.0.3, we are currently verifying if previous builds of macOS 11 have the same issue.
EDIT: A little bit more info that I have found so far:
The following error messages show up in system.log when trying to connect to the AFP share:
Feb 12 23:56:54 MBPTom com.apple.xpc.launchd[1] (NetworkExtension.com.sophos.endpoint.networkextension.10.0.3.221820[5253]): Service exited due to SIGILL | sent by exc handler[5253]
Looking up what this message means, turns out that macOS is killing the process, because it's using too much resources, leading back to the previously linked thread.
So far I haven't found a complete reproducable sample, but sometimes the connection just goes through, and an subsequent connections are fine as well, the extension seems to be running with a CPU usage around 70-80% at these times.
Added some more information found
[edited by: Tom Matheussen at 11:01 PM (GMT -8) on 12 Feb 2021]
