From 9a9f82b59efaf98073d450c71093a4492fc7be48 Mon Sep 17 00:00:00 2001
From: Carter Li <zhangsongcui3371@sina.com>
Date: Fri, 11 Sep 2026 10:40:44 +0800
Subject: [PATCH] Processes (macOS): adds a comment

---
 src/detection/processes/processes_apple.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/detection/processes/processes_apple.c b/src/detection/processes/processes_apple.c
index 719b1b1da..727aeac02 100644
--- a/src/detection/processes/processes_apple.c
+++ b/src/detection/processes/processes_apple.c
@@ -31,10 +31,10 @@ const char* ffDetectProcesses(const FFProcessesOptions* options, FFProcessesResu
 
         pid_t pid = proc->kp_proc.p_pid;
         struct proc_taskinfo taskInfo;
-        if (proc_pidinfo(pid, PROC_PIDTASKINFO, 0, &taskInfo, sizeof(taskInfo)) != sizeof(taskInfo)) {
-            continue;
+        if (proc_pidinfo(pid, PROC_PIDTASKINFO, 0, &taskInfo, sizeof(taskInfo)) == sizeof(taskInfo)) {
+            // NOTE: This fails for system processes
+            result->threads += (uint32_t) taskInfo.pti_threadnum;
         }
-        result->threads += (uint32_t) taskInfo.pti_threadnum;
     }
 
     return nullptr;