Big Sur kernel panic

AdGuard knows there is an issue but they claim they can't fix it from their side… yet the problem goes away when you uninstall their software:

https://github.com/AdguardTeam/AdguardForMac/issues/761

AdGuard was suspect because its extension was clearly mentioned in the backtrace:

Kernel Extensions in backtrace:
         com.adguard.nfext(27.0)[4AF16C66-CBFC-369B-8F0A-6FB96F1D536E]@0xffffff7fb1185000->0xffffff7fb1188fff

This is a rollup of findings from this thread as well as others here and in other forums:

The most important thing to know: "watchdog" is a mechanism that causes a kernel panic when some portion of the operating system freezes for about two minutes. These system-hangs are symptoms, and they can have many causes. Many of you will need to solve your problem in a different way.

The three most common causes: Kernel extensions (vendors often label them as "drivers"), iOS sync issues, and USB or Thunderbolt problems.

Kernel Extensions:

Kernel extensions often come with software that supports third-party peripherals, as well as security software such as firewall or antivirus software.

If you're using something with a kernel extension, make sure you have the most recent version of the extension. Also, visit the vendor website and ensure that the vendor explicitly says the extension supports Big Sur. If they don't specifically say this, then you take a big risk by continuing to use it. There is a very high probability that an out of date or unsupported extension will cause kernel hangs or panics.

You should always perform the above checks prior to upgrading macOS versions. In general, it's best to select hardware that does not require the installation of additional kernel extensions.

iOS Sync Issues:

If you have one or more iOS devices (iPhone, iPad, iPod Touch) that are configured to support Wi-Fi sync, then these can cause kernel panics under Catalina and Big Sur. The more devices you have, the greater the chance of a panic.

macOS does not cleanly handle weak Wi-Fi or devices leaving Wi-Fi range in the middle of a sync. There is a bug that can cause macOS to unmount the wrong volume when sync fails. This can even result in your system volume being unmounted, which hangs the OS.

A common scenario is plugging your iPhone into a power charger that is distant from your Mac, where Wi-Fi is weak. This triggers a Wi-Fi sync session from a bad network position.

If you have one or more iOS devices, connect each via a USB to Lightning cable, find the device in the Finder sidebar (remember, Catalina and newer do not use iTunes for this), and disable the "Sync with this (device) over Wi-Fi" option. You can always reverse this change later if you find that your kernel panics continue.

USB and Thunderbolt Issues:

As much as many of us resist advice about unplugging all external components and gradually re-introducing them over time in order to isolate issues, this often points to the solution. Even many 20-year Mac users have found that they spent waiting for corrective OS updates when a $2 USB cable was the problem.

USB and Thunderbolt issues can take many forms. Generally speaking, however, macOS has little tolerance for any peripheral acting erratically. A device that does not cause visible symptoms under Windows or Linux can still cause problems under macOS.

A weak cable can cause data errors, or it can cause macOS to incorrectly detect that the device is repeatedly attached and detached. If either happens too frequently it can cause problems with macOS or macOS kernel extensions, including the drivers that ship as part of macOS. Similar to the iOS and Wi-Fi issue, repeatedly attaching and detaching USB drives can cause the wrong device to become unmounted, for example.

A very long cable or a low-quality cable can act as an antenna, adding radio interference that inhibits the correct operation of your Mac's hardware.

A peripheral which does not correctly report its power draw can cause not only that peripheral but other peripherals (including internal parts of the Mac) to shut down in an immediate and unclean fashion in order to protect your Mac and peripherals.

Keep in mind that most modern external monitors have a USB or Thunderbolt bus component in addition to the display signal component. Monitors are not immune from causing USB or Thunderbolt issues.

Good Luck

I know these panics are hair-pullingly frustrating. I feel that pain. I personally dealt with two machines that took months to resolve, and even went through getting logic board swaps that didn't solve the issue. If this saves even one of you from a similar experience, then I'm glad I took the time to roll this all up.

Solved it! This Mac was provisioned by my org and has CrowdStrike Falcon 6.17 (130.05) installed. They had me disable the network filter using "sudo /Applications/Falcon.app/Contents/Resources/falconctl disable-filter" and it's been running solid for 24 hours now, with no reboot, even overnight which happened almost all of the time.

Seeing that it was a network filter, and little snitch was having the same problems, if you are getting "com.apple.remoted" watchdog timeouts, check if you have any network filters installed in System Preferences → Network (shown as "content filter" on the list of items on the left)

I believe I’ve solved my panics (and persistent SPOD and other transient hangs) by replacing my iMac’s internal drive (it was a Fusion setup) (with an SSD, as it happened). On the advice of a friend, I ran the app DriveDX, which does a nice job with SMART (and other?) stats, and it immediately reported my hard drive as a spinning disaster area. Error rates through the roof, a lot of unrecoverable errors. I installed the SSD via an OWC kit (recommended; not as hard as I feared), restored from a Time Machine backup, and after a day or two of resyncing and rebuilding and backing up, no more panics, no more SPODs.

I hypothesize that the bad drive was causing very slow access, and when that happened in a synchronous operation subject to a timeout resulting in a panic, poof. I can imagine the comment on the panic call: “this should never take this long”. True, but...

I’d earlier blamed Backblaze and Spotlight indexing for my SPODs, and in a way I was right. But their intensive disk activity just provided the conditions necessary for the panic and other issues.

I conjecture that the same could be true of the association with USB devices, that some of them occasionally cause delays in code paths subject to panic-on-timeout. If I’m right, Apple ought to be giving us clearer error messages about the underlying timeout, pointing to the offending device. And they sure as **** should be complaining loudly about failing system drives.

HTH

I wanted to follow-up on my post with some important additional information that I hope someone will find helpful. For the past few days I have been pointing the finger at CalDigit for the kernel panic issues I have been having.

I have been in conversation with the company's CEO and I am very pleased at the level of assistance he has provided me. I was told that Caldigit support was backlogged from the holidays and that is most likely the reason why they went silent about this issue. However, the CEO has been in constant contact with me to examine the kernel pack issue including looking at my crash log.

I believe he MAY have found the root cause of the problem. I say that tentatively because a kernel panic could happen in the next few minutes. However, one has not happened since I applied the fix that he recommended:

====

"As far as your kernel panic,

A Few suggestions-

1. Have you checked with Adguard to see if they have newer driver release? If not, we suggest you remove that software temporarily from your system. They have some information on their site - https://adguard.com/en/removal.html

If you still run into panic issue, please send off the logs, we can help to investigate.

2. When you un-dock or re-dock, please make sure your Mac’s lid is open before undocking or redocking.

For example:

To Un-dock: With the lid open, unplug the Thunderbolt cable. Then close lid.

To Re-dock: Open lid first, then connect the Thunderbolt cable to re-dock.

Through our repetitive tests, we’ve found this habit of sequence would greatly reduce panic issues.

We believe it’s probably related to the GPU or Intel CPU. We need more time to investigate the issues and will submit our final findings to Apple."

====

It seems like ADGUARD could have been the culprit.

The issue also could have involved disconnecting the MBP while the lid was closed.

Will keep an eye on things and let all of you know how this workaround is progressing.

Remove or check for new versions of the following kernel extensions:

com.uaudio.driver.UAD2System	9.13.1
com.waves.driver.soundgrid	12.2.0
com.Sonarworks.driver.Sonarworks	1.8.11

In particular, the Waves Soundgrid driver has been known to cause kernel panics in the past.

Thanks Dogcow-Moof! Sonarworks just updated as new version supporting Big Sur, Waves updated and driver removed (though it still looks be be installed in Waves Applications folder and can only be removed fully along with Applications, which is silly, thanks Waves!), UA was already updated. Will keep tabs should this continue now updated. It only happened after updating to 11.2, earlier 11.1 and below working fine with previous installed apps.. etc.

Update: my iMac has been running for 14 days now so I'm starting to be a bit optimistic. My #1 suspect right now is an ANT+ USB-dongle. This is used to connect my indoor cycling stuff (smart trainer, heart rate monitor, etc) for use with Zwift and the like.

At first I did not suspect this at all as the panics mostly happened when I was working (video conferencing mostly) and never when I was riding my bike.

But maybe the culprit is exactly that: the *lack* of input from a device which sends watchdogd into some sort of "waiting for Godot"-mode. So now I only put in the dongle when actually riding the bike, and take it out when finished.

Hard to prove this theory, but if it is correct, the issue is indeed USB-related as others have suggested.

Is it possibly some MacOS to monitor awake event? Have you tried disconnecting the monitors and resetting the some Mac initial settings? Have you tried resetting the perimeter RAM? This is a great list of startup key combinations - https://support.apple.com/en-gu/HT201255.

Once you reset the pram, set the LG profile and apply "disable monitor" energy saver to test. Typically, articles might suggest resetting the System Management Controller... usually for power management... seeing that this is a "power" type event, you might just try SMC reset... take a look at https://support.apple.com/en-us/HT201295

Hope this proves helpful

Resetting pram, disconnecting and reconnecting, adjusting settings, power all down, disconnect peripherals, power up and add peripherals one at a time, and similar supposed remedies have not permanently fixed the problem, so far as I can tell from posts by other people. Kernel panics come back.

Then it is a hardware problem or a problem in Apple's kernel extensions. If the latter, you'd see nearly every user of that Mac have similar problems.

You generally cannot "fix" the cause of a kernel panic unless the cause is a third-party kernel extension or external hardware.

You have to take it to an Apple Store or Authorized Repair Center to get the underlying hardware fixed.

If it is an Apple kernel extension bug, short of someone accidentally stumbling upon it, the only way Apple will find out is if enough people bring in their Macs for evaluation/repair.

I have the same problem with iMac late 15. I have a reset every time the monitor goes to sleep for 30 minutes. I have found the solution, I just uncheck the Enable Power Nap in Setting/EnergySaver and it has been good, no panic for 2 days

FWIW.....I still think this requires an update from Apple.....but I appear to have resolved my issue.

I did not have the issue when in Safe Boot. So, since I was getting daily crashes when not is Safe Boot, I decided to start removing things I thought might be contributing to the issue. So, I still have the various power settings Disabled (Auto Graphics Switching and Power Nap....where I was still having crashes) and then I also removed Little Snitch, as well as Avast A/V.

So far.......two days solid without any crashes. Going to run another day and then will try running with external monitor attached to see how it goes.

Just thought I would share this admittedly anecdotal information :-).

I have reinstalled both Mac OS Big Sur and Parallel Desktop from scratch today and the issue seems to be fixed. The computer remains stable with an active VM for over 11 hours now. I am not sure what is going on.

For what it's worth, I observed on several opportunities issues of similar and other kinds with peripherals.

Upon last update to 11.1.0 I twould get stuck in the process and the moment i unplugged my external backup drive (after 2 hours of waiting ) it finished the the backup properly.

This morning I had a Kernel Panic similar to the one you described right after connecting the external backup drive.

Also I observerd similar issues earlier, i.e. during beta period, reboots/crashes and boot issues alwas related to external drives of "various kind" I'm using a multitude of different externals, like 4 differenet flash drives, 2 different hard drives / SSDs, Memory Sticks etc.

EDIT: Of course I sent the crash report to apple 😉

I’ve been seeing the user-space watchdog panic on an iMac with 11.1. My conjecture is that it’s related to heavy Spotlight indexing (I’d cloned a user account, effectively, so lots to do). My workaround was to quit all apps and disable Time Machine and Backblaze until the indexing was finished. So far so good, though the 3-4 panics I’ve seen were erratic enough that I wouldn’t be all that surprised to see another one.

Keep sending those reports to Apple...