diff --git a/src/common/impl/sysctl.c b/src/common/impl/sysctl.c
index 122a79091..29d4a3afc 100644
--- a/src/common/impl/sysctl.c
+++ b/src/common/impl/sysctl.c
@@ -116,18 +116,3 @@ int64_t ffSysctlGetInt64(const char* propName, int64_t defaultValue) {
     }
 }
 #endif // OpenBSD
-
-void* ffSysctlGetData(int* request, u_int requestLength, size_t* resultLength) {
-    if (sysctl(request, requestLength, nullptr, resultLength, nullptr, 0) != 0) {
-        return nullptr;
-    }
-
-    void* data = malloc(*resultLength);
-
-    if (sysctl(request, requestLength, data, resultLength, nullptr, 0) != 0) {
-        free(data);
-        return nullptr;
-    }
-
-    return data;
-}
diff --git a/src/common/sysctl.h b/src/common/sysctl.h
index 7e59ec663..9d12df6fc 100644
--- a/src/common/sysctl.h
+++ b/src/common/sysctl.h
@@ -14,4 +14,3 @@ const char* ffSysctlGetString(const char* propName, FFstrbuf* result);
 [[nodiscard]] int ffSysctlGetInt(const char* propName, int defaultValue);
 [[nodiscard]] int64_t ffSysctlGetInt64(const char* propName, int64_t defaultValue);
 #endif
-[[nodiscard]] void* ffSysctlGetData(int* request, u_int requestLength, size_t* resultLength);
diff --git a/src/detection/wm/wm_apple.m b/src/detection/wm/wm_apple.m
index c4bc780a2..e02c089bb 100644
--- a/src/detection/wm/wm_apple.m
+++ b/src/detection/wm/wm_apple.m
@@ -11,16 +11,23 @@
 
 const char* ffDetectWMPlugin(FFstrbuf* pluginName) {
     int request[] = { CTL_KERN, KERN_PROC, KERN_PROC_ALL };
-    u_int requestLength = ARRAY_SIZE(request);
+    size_t length;
 
-    size_t length = 0;
-    FF_AUTO_FREE struct kinfo_proc* processes = ffSysctlGetData(request, requestLength, &length);
-    if (processes == nullptr) {
-        return "sysctl(CTL_KERN, KERN_PROC, KERN_PROC_ALL) failed";
+    if (sysctl(request, ARRAY_SIZE(request), nullptr, &length, nullptr, 0) != 0) {
+        return "sysctl({CTL_KERN, KERN_PROC, KERN_PROC_ALL, nullptr}) failed";
     }
-    assert(length % sizeof(struct kinfo_proc) == 0);
 
-    for (size_t i = 0; i < length / sizeof(struct kinfo_proc); i++) {
+    // The process table may change between the two sysctl calls; retry with a larger buffer.
+    length += length / 8 + sizeof(struct kinfo_proc);
+    FF_AUTO_FREE struct kinfo_proc* processes = malloc(length);
+
+    if (sysctl(request, ARRAY_SIZE(request), processes, &length, nullptr, 0) != 0) {
+        return "sysctl({CTL_KERN, KERN_PROC, KERN_PROC_ALL, processes}) failed";
+    }
+
+    uint32_t count = (uint32_t) (length / sizeof(struct kinfo_proc));
+
+    for (size_t i = 0; i < count; i++) {
         const struct kinfo_proc* proc = &processes[i];
         if (proc->kp_eproc.e_ppid != 1) {
             continue;