Removing a system extension from a correctly-signed and setup "uninstaller" app fails

Hey folks,

I have an application that ships a CoreMedia I/O system extension to create a virtual camera.

We separately ship an "uninstaller" app, which is a notarised AppKit app. This uninstaller removes the app, containers, and the system extension via the following API:

let request = OSSystemExtensionRequest.deactivationRequest(forExtensionWithIdentifier: pluginIdentifier, queue: .main)
request.delegate = self
OSSystemExtensionManager.shared.submitRequest(request)

The OSSystemExtensionRequest API does correctly deliver metadata via propertiesRequest(forExtensionWithIdentifier: …), but when we attempt to remove the extension using the above snippet, we get a failure OSSystemExtensionError.extensionNotFound.

The uninstaller app is signed with the same entitlements and certificate as the host app. It also embeds a copy of the system extension as required by the API.

I think the crux of the issue is: Should this be expected to work? We're all code-signed correctly etc, and the only difference is that the removal request is coming from an app with a different bundle identifier to the one that installed it start with.

Thanks!