ios/SecItemDelete not accepting a SecIdentityRef/kSecMatchItemList - iphone

Question

In a simple methods to delete Certs by CN (the certs have previously been put there by SecItemAdd from a PKCS12 import); I am getting the error:
Property list invalid for format: 200 (property lists cannot contain objects of type 'SecIdentity')
Where based on https://developer.apple.com/documentation/security/1395547-secitemdelete I think I am following the instruction:
To delete an item identified by a transient reference, specify the
kSecMatchItemList search key with a reference returned by using the
kSecReturnRef return type key in a previous call to the
SecItemCopyMatching or SecItemAdd functions.
to the letter. Code below:
NSDictionary * attributes;
NSString * cnString = #"/CN=foo";
attributes = [NSDictionary dictionaryWithObjectsAndKeys:
(__bridge id)(kSecClassIdentity), kSecClass,
cnString, kSecMatchSubjectContains,
kSecMatchLimitAll, kSecMatchLimit,
kCFBooleanTrue, kSecReturnRef,
nil];
CFArrayRef result;
status = SecItemCopyMatching((__bridge CFDictionaryRef)(attributes),
(CFTypeRef *)&result);
if (status == noErr) {
for(int i = 0; i < CFArrayGetCount(result); i++) {
SecIdentityRef item = (SecIdentityRef) CFArrayGetValueAtIndex(result, i);
NSLog(#"Item #%d: %#", i, item);
attributes = [NSDictionary dictionaryWithObjectsAndKeys:
(__bridge id)(kSecClassIdentity), kSecClass,
[NSArray arrayWithObject:(__bridge id)item], kSecMatchItemList,
kSecMatchLimitOne, kSecMatchLimit,
nil];
status = SecItemDelete((__bridge CFDictionaryRef)(attributes));
if (status != noErr || status != errSecItemNotFound)
NSLog(#"Delete %d/%#failed: %ld (ignored)", i,item, status);
};
};
The output on the console is:
Item #0: <SecIdentityRef: 0xc7359ff0>
straight after the find (and if the search is widened we get an array of these).
And then from deep inside Security.dylib:
Property list invalid for format: 200 (property lists cannot contain objects of type 'SecIdentity')
To ultimately bail with:
Delete 0/<SecIdentityRef: 0xc7359ff0>failed: -50 (ignored)
What am I doing wrong?

Answer 1

To quote from the documentation found in the header file SecItem.h, part of the Security framework:
By default, this function deletes all items matching the specified query.
You can change this behavior by specifying one of the follow keys:
To delete an item identified by a transient reference, on iOS,
specify kSecValueRef with a item reference. On OS X, give a
kSecMatchItemList containing an item reference.
To delete an item identified by a persistent reference, on iOS,
specify kSecValuePersistentRef with a persistent reference returned by
using the kSecReturnPersistentRef key to SecItemCopyMatching or
SecItemAdd. On OSX, use kSecMatchItemList with a persistent reference
returned by using the kSecReturnPersistentRef key with
SecItemCopyMatching or SecItemAdd.

Answer 2

This has been fixed in the latest GM drop. Reality is now in sync with the documentation.