//go:build darwin

package tailcore

import (
	"os"

	wgtun "github.com/tailscale/wireguard-go/tun"
)

// makeTUN wraps the OS-provided utun fd (handed over by NEPacketTunnelProvider) as a wireguard-go
// device. Pass mtu=0 so CreateTUNFromFile does NOT setMTU — inside a Network Extension that ioctl is
// EPERM ("operation not permitted"); iOS owns the utun MTU via NEPacketTunnelNetworkSettings.mtu.
// (wireguard-go only calls setMTU when mtu > 0.)
func makeTUN(fd int32) (wgtun.Device, error) {
	return wgtun.CreateTUNFromFile(os.NewFile(uintptr(fd), "tun"), 0)
}