[N_Lens]

I'm left wondering what this covert mesh traffic is actually accomplishing, and whether it's actually controversial or whether the researcher came across a red herring (Perhaps background file transfer such as airdrop while in airplane mode, unlikely as that sounds?).

[TakeFlight007]

Good catch! checked sharingd (PID 75) in spindump: <0.001s CPU time while mDNSResponder processed the 84MB. Traffic attribution rules out AirDrop. The 67:1 RX/TX asymmetry and idle sharing daemon confirm this isn't file transfer.

[taraindara]

My guess would it has to do with find my iPhone and AirTag tracking features.

[TakeFlight007]

Not possible due to directionality and volume:

Find My/AirTag: Characteristic low-payload outbound beacons (Egress).

Observed Reality: 84.5 MB Ingress (Received) vs. 1.25 MB Egress.