Using our transparent proxy provider, I noticed that the mbuf usage was... weird:
15839/750028 mbufs in use:
15810 mbufs allocated to data
29 mbufs allocated to packet headers
734189 mbufs allocated to caches
The amount allocated to caches does go down a bit, but nothing significantly. I started looking into this because I've had a couple of panics from remoted not checking in enough, and it was (as I recall, I can't find the crash logs now) mbuf-related.
I've looked through an older version of the xnu source, and nothing jumped out, but that doesn't have the code for the network extension support.
I hate mbufs and always have.
I went into far more details and analyses and question-asking in Transparent Proxy Provider, UDP, mbufs, and inevitable panics