Fix handling of errSSLClosedGraceful from SSLWrite on macOS

src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs

@@ -177,6 +177,9 @@ public static ProtocolToken EncryptMessage(
                             case PAL_TlsIo.WouldBlock:
                                 token.Status = new SecurityStatusPal(SecurityStatusPalErrorCode.ContinueNeeded);
                                 break;
+                            case PAL_TlsIo.ClosedGracefully:
+                                token.Status = new SecurityStatusPal(SecurityStatusPalErrorCode.ContextExpired);
+                                break;
                             default:
                                 Debug.Fail($"Unknown status value: {status}");
                                 token.Status = new SecurityStatusPal(SecurityStatusPalErrorCode.InternalError);

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamAlertsTest.cs

@@ -153,6 +153,77 @@ public async Task SslStream_StreamToStream_DataAfterShutdown_Fail()
             }
         }
 
+        [Theory]
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task SslStream_WriteAfterRemoteCloseNotify_ThrowsIOException(bool useAsync)
+        {
+            (Stream clientStream, Stream serverStream) = TestHelper.GetConnectedStreams();
+            using (clientStream)
+            using (serverStream)
+            using (var client = new SslStream(clientStream, true, AllowAnyServerCertificate))
+            using (var server = new SslStream(serverStream))
+            using (X509Certificate2 certificate = Configuration.Certificates.GetServerCertificate())
+            {
+                await Task.WhenAll(
+                    server.AuthenticateAsServerAsync(certificate),
+                    client.AuthenticateAsClientAsync(certificate.GetNameInfo(X509NameType.SimpleName, false))
+                ).WaitAsync(TestConfiguration.PassingTestTimeout);
+
+                var buffer = new byte[1024];
+
+                // Server initiates shutdown
+                await server.ShutdownAsync().WaitAsync(TestConfiguration.PassingTestTimeout);
+
+                // Client reads the close_notify
+                int bytesRead = await client.ReadAsync(buffer, 0, buffer.Length).WaitAsync(TestConfiguration.PassingTestTimeout);
+                Assert.Equal(0, bytesRead);
+
+                // Client attempts to write after receiving close_notify
+                // On macOS with Secure Transport, this throws immediately
+                // On Linux/Windows, the first write may succeed, subsequent operations fail
+                if (PlatformDetection.IsOSX)
+                {
+                    if (useAsync)
+                    {
+                        await Assert.ThrowsAsync<IOException>(() => client.WriteAsync(buffer, 0, buffer.Length)).WaitAsync(TestConfiguration.PassingTestTimeout);
+                    }
+                    else
+                    {
+                        Assert.Throws<IOException>(() => client.Write(buffer, 0, buffer.Length));
+                    }
+                }
+                else
+                {
+                    // On other platforms, write may succeed (sends data despite close_notify)
+                    // The connection may be closed by the server or subsequent operations may fail
+                    // We just verify that we don't crash or hang
+                    if (useAsync)
+                    {
+                        try
+                        {
+                            await client.WriteAsync(buffer, 0, buffer.Length).WaitAsync(TestConfiguration.PassingTestTimeout);
+                        }
+                        catch (IOException)
+                        {
+                            // Also acceptable on some platforms
+                        }
+                    }
+                    else
+                    {
+                        try
+                        {
+                            client.Write(buffer, 0, buffer.Length);
+                        }
+                        catch (IOException)
+                        {
+                            // Also acceptable on some platforms
+                        }
+                    }
+                }
+            }
+        }
+
         private bool FailClientCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
         {
             return false;