Let's disambiguate OS first: do you mean the kernel or userland? If userland: Little Snitch loads a kernel extension and monitors every userland process. If k

Let's disambiguate OS first: do you mean the kernel or userland? If userland: Little Snitch loads a kernel extension and monitors every userland process. If kernel: The XNU kernel is open source, so you can check that it doesn't work around Little Snitch and Apple doesn't do telemetry in the kernel (which would be... weird). Of course, theoretically, Apple could work around this using e.g. malicious code in the EFI firmware. But I am pretty sure that someone would've already found this by monitoring at a router.