We've run in to an issue with the sockif structure. The sf_sonewconn1 item in the structure is typed as follows: struct socket *(*sf_sonewconn1)(struct socket *, int, struct kextcb *); The real sonewconn function takes a socket* of a socket listening for connections, allocates a new socket*, fills it in and returns it. If an sf_sonewconn1 is specified it is called in sonewconn just after the socket structure as been allocate. The new socket* is passed as the first parameter. All of the other functions in that structure return an int. By returning an int, the other functions have the option of returning: 0 - no error, keep processing as usual EJUSTRETURN - everything is fine, don't process any further, just return Anything else - something went wrong, propagate the error Due to the definition, sf_sonewconn1 can not tell the caller it just wants the caller to return as if everything had succeeded (EJUSTRETURN). Is anyone using the sf_sonewconn1 item in the sockif structure? Does anyone see a need for a socket filter to return a different socket*? I'd like to change sf_sonewconn1 to: int (*sf_sonewconn1)(struct socket *, int, struct kextcb *); Or int (*sf_sonewconn1)(struct socket **, int, struct kextcb *); Thanks, -josh