OS updates for M1 macs (like today's 12.2 security update) connect to some random 17./8 on port 80 to "personalize", which presumably transmits your hardware serial unencrypted? i'm redoing it now, while pcapping, to see what it is actually sending...