I’ll see about posting this to the VirtualBox bugtracker.
After closing Whonix Workstation, Gateway, and VirtualBox itself, the process VBoxIntNetSwitch remains alive. Under the Memory tab in macOS’ Activity Monitor, the RAM usage of that process somehow correlates to the amount of material downloaded, but not exactly. For instance, the process starts with Gateway, and when I downloaded a high resolution 52 MB image, the RAM usage increased to 20 MB. However, I then downloaded a 77 MB one, and it only increased by around 4 MB. When I close the Whonix VMs, it decreases very slightly. Strange behavior.
The process doesn’t stop if I press Quit in Activity Monitor, I have to use Force Quit.
I tried replicating the behavior with a different OS. I opened a Windows 10 VM, downloaded and installed several updates, keeping it open for a while and restarting after updates, but the VBoxIntNetSwitch process never started.
I’ve been using Tor with an obsf4 bridge, configured in Whonix Gateway. I’m unsure if disabling it makes a difference, but I’d rather not because I don’t like my ISP seeing I’m using Tor.
VirtualBox, the extension pack, both Whonix VMs, and macOS Monterey are all up to date.