macOS Golden Gate quietly un-fixes the XPdb flock bug: an inverted file-read-data rule in the platform sandbox profile makes XProtect’s behavioral events database readable again, resurrecting the denial-of-service attack against XProtectBridgeService.

We discuss a bug in XProtect behavior events abused in the wild in the current XCSSET malware campaign, then we explain why XProtect behavioral telemetry is fundamentally flawed.