Starting from macOS Catalina Beta, Apple refactored the architecture of the 80211 Wi-Fi client drivers and renamed the new generation design to IO80211FamilyV2. Compared with IO80211Family (V1), modules such as Version 2 and AppleBCMWLANCore integrate the original AirPortBrcm series drivers and further expand features such as Sidecar and Skywalk. These latest changes provide better support and protection for communication and data sharing between devices. Of course, we should also realize that new features are always accompanied by new vulnerabilities and potential risks of being attacked.This research will delve into each of the affected Wi-Fi kernel components and explore new attack surfaces. We will also share with you more than a dozen zero-day vulnerabilities, which can be classified into at least four categories from the high level of the architecture:Vulnerabilities affecting only V1. In other words, V2 fixes vulnerable functions. Unfortunately, these important improvements have not been synchronized with other system platforms, so we can use them to attack targets like the latest macOS High Sierra and Mojave.Vulnerabilities affecting only V2. In short, developers mistakenly introduced security flaws into Catalina when porting existing V1 functions.Vulnerabilities that affect both V1 and V2.Vulnerabilities in the new features of V2. In fact, many codes have not been rigorously audited and tested. Through these brand new cases, this presentation will help you better understand the design and security challenges of Apple's 80211 Wi-Fi subsystem.