@akindyakov I did a bunch of work to reproduce this issue https://github.com/facebook/osquery/issues/5326 let me know if I can assist further with it at any point.

Ok, I'll have look on it tomorrow