Why can't driverkitd talk to trustd in ios 26.4.1?

gistfile1.txt

We experience the same behaviour on ios 18.2, 26.4.1 and 26.5.1 beta

All the lead-up to activating the custom driver (yes I have a dev entitlement embedded in there too) is working 
but driverkitd doesn't appear to be able to talk to trustd to activate it:
  
  Working: SpringBoard → trustd (11:47:50)
  SpringBoard    activating connection: name=com.apple.trustd     ← SUCCEEDS
  trustd         activating connection: peer=com.apple.trustd.peer[34]
  trustd         cert[0]: SubjectCommonName =(leaf)[]> 0          ← evaluates cert

  Working: amfid → trustd (11:47:50, 11:48:08)
  amfid          activating connection: name=com.apple.trustd     ← SUCCEEDS
  trustd         activating connection: peer=com.apple.trustd.peer[56]
  trustd         cert[0]: SubjectCommonName =(leaf)[]> 0          ← evaluates cert

  FAILING: driverkitd → trustd (11:48:21)
  driverkitd     Realize dext com.****.****TestHarness.****RelayDriver
  driverkitd     activating connection: name=com.apple.trustd     ← DENIED
  kernel         Sandbox: driverkitd(80) deny(1) mach-lookup com.apple.trustd
  driverkitd     Failed to talk to trustd after 4 attempts.
  driverkitd     Trust evaluate failure:
                 [repeats 3x]
  driverkitd     Failed to get signature type: Unable to create SecRequirement
                 for checking Apple root: 4294967246

  There's also an interesting securityd error when trustd tries to access the keychain:
  securityd      trustd[123] copy_parent_certificates Error Code=-34018
                 "Client has neither application-identifier nor keychain-access-groups entitlements"