Did forensic analysis on my iPhone during Airplane Mode isolation. Kernel stats show 2,657 packets transmitted and 84.5MB processed through mDNSResponder while interfaces report "inactive". Found a parallel utun2 tunnel bound to IDS framework that persists during isolation. Applied Shannon-Hartley theorem to verify the channel capacity supports this volume. Either I'm misunderstanding legitimate system behavior, or this is a covert channel. Reproducible steps and raw evidence included.
Interface stats are cumulative since boot (eg: not real-time), mDNSResponder traffic includes all historical Bonjour activity. utun tunnels are standard iCloud/VPN infrastructure. Shannon-Hartley math proves WiFi can move data, not that anything covert is happening.
The spindump captures a precise 2.00-second window (2025-12-31 13:35:14) where mDNSResponder (PID 10252) is in an active execution state with Priority 31 scheduling. Real-time thread activity and kernel buffer management do not occur for "historical" data.
https://github.com/JGoyd/NeuralNet/issues/1#issuecomment-370...
This capability is one of the strong selling points for consumers. The modern, average thief will often toss away these devices and settle with the rest of the loot because of this.
Sounds like OP wasn't aware of this.
84.5 MB through utun2/IDS during stated isolation—benign or not—contradicts "wireless features turned off" and users have no verification path.
The "closed source" problem you identified is the core issue. So to be rigorous, plausible deniability ends where the telemetry contradicts the UI.
N_Lens•1mo ago
TakeFlight007•1mo ago
taraindara•1mo ago
TakeFlight007•1mo ago
Find My/AirTag: Characteristic low-payload outbound beacons (Egress).
Observed Reality: 84.5 MB Ingress (Received) vs. 1.25 MB Egress.