Talos 1.13.7 boots into Maintenance Mode but never registers with Omni (TLS succeeds, apid unavailable)

[albatros1966]

Bug Report: Talos 1.13.7 boots successfully but never registers with Omni
Summary
A Talos 1.13.7 machine boots successfully into Maintenance Mode and establishes a TLS connection to the Omni SideroLink endpoint, but it never registers with Omni.
The machine never appears in the Omni UI and remains permanently in Maintenance Mode.

Additionally, the Talos maintenance API is unavailable because TCP port 50000 is actively refused.

Environment
Omni
Omni SaaS
Talos
v1.13.7
Virtualization
VMware Fusion
UEFI firmware
NAT networking
amd64 guest
Installation media
Generated directly from Omni using Generate Installation Media
ISO regenerated multiple times
No manual modifications
No custom remastering
Expected behavior
After booting the installation media:
Talos enters Maintenance Mode.
SideroLink connects to Omni.
Machine registration completes.
A Machine resource is created.
The machine becomes visible in the Omni UI.
Actual behavior
The machine:
boots successfully
enters Maintenance Mode
receives a DHCP lease
resolves DNS
has Internet connectivity
establishes a TLS connection with
nighthawk.siderolink.na-west-1.omni.siderolabs.io

exchanges several KB of encrypted application data
disconnects
However:
no Machine resource is created
Omni continues to display "No Machines Found"
registration never completes
Network verification
Verified:
DHCP
default gateway
DNS resolution
outbound connectivity
TCP/443
TLS handshake
A tcpdump confirms:
TCP connection established
TLS handshake completed successfully
encrypted application data exchanged
connection closed normally afterwards
No connectivity problems were observed.
Omni verification
Verified:
Join Token exists
Join Token regenerated
Installation media regenerated
Correct schematic selected
Correct Omni account
UEFI boot
VMware networking
Talos API
The Talos maintenance API is unavailable.
Every talosctl command fails with:

rpc error: code = Unavailable desc = connection error:
transport: Error while dialing:
dial tcp :50000:
connect: connection refused

Examples:
talosctl version
talosctl logs siderolink
talosctl get members

All fail identically.
Network verification:

ping OK
TCP/50000 Connection refused

This appears to indicate that apid is not listening, despite the machine reaching Maintenance Mode.
Timeline
Boot
↓

DHCP

↓

DNS

↓

Internet connectivity

↓

TLS connection to SideroLink

↓

Encrypted application data exchanged

↓

Connection closed

↓

No registration

↓

Machine never appears in Omni

Questions
Is there any known issue where SideroLink successfully establishes TLS but registration is rejected before a Machine resource is created?
Is it expected that apid is unavailable (TCP/50000 refused) while the machine is in Maintenance Mode?
Are there known VMware Fusion compatibility issues with Talos 1.13.7 that could prevent apid from starting while allowing SideroLink networking to function?
Are there any early boot diagnostics or kernel logs that could explain why apid is not available even though networking is operational?
Any guidance on additional diagnostics would be greatly appreciated.

[smira]

This is unreadable, and lacks any details.

[rothgar]

To answer one of your questions, yes port 50000 is refused on the local network when a machine has a siderolink configuration. This is a default setting for better security of maintenance nodes when using Omni.

My guess with this issue is from the UDP communication of wireguard and you should try using HTTP/2 tunneling for the siderolink connection configuration. It's a setting you can check in Omni when generating your installation media.