SOCD report detected: (AP watchdog expired)

sorry mean't to link this diagram instead from https://support.apple.com/en-ca/guide/security/sec59b0b31ff/web

other possible meaning for D in SOCD

-direct memory access (DMA)

-DRAM

i can't see any use further troubleshooting this. it's a black box that can only be fixed by vendor.

my guess is it's a real doozy of a bug too.

Happened to me for the first time yesterday. Have had my M1 MacBook Air for just over six months. Have an external LG monitor + Seagate back-up drive attached (since day 1) and added an Satechi external hub a few months ago. So far has only happened the once for me - came up with a green screen, then restarted and I got the AP watchdog expired message (see log entry below).

Panic (system crashes) log:

 Source: /Library/Logs/DiagnosticReports/.contents.panic

 Size: 247 bytes

 Last Modified: 29/6/21, 10:46 am

 Recent Contents: {"files_to_attach":["\/Library\/Logs\/DiagnosticReports\/panic-base-2021-06-29-104613.000.panic"],"log_path":"\/Library\/Logs\/DiagnosticReports\/panic-base-2021-06-29-104613.000.panic","panic_string":"SOCD report detected: (AP watchdog expired)"}

One thing I've wondered reading this thread and another (https://discussions.apple.com/thread/252511597?answerId=255469239022&login=true&page=1), is whether it is only happening to Macs with M1 chips? Haven't seen anyone who has posted yet talking about the problem with older Macs.

Also, I am powering via my external monitor with a USB cable. It regularly seems to lose connection and I have to pull the cable out and put back in to get the laptop to charge. So maybe a USB cable connection or some sort of power related issue?

d3cbgf wrote:

sorry mean't to link this diagram instead from https://support.apple.com/en-ca/guide/security/sec59b0b31ff/web

https://discussions.apple.com/content/attachment/c0d9c77d-6920-4c59-a53e-b45d581c1735

other possible meaning for D in SOCD

-direct memory access (DMA)

-DRAM

i can't see any use further troubleshooting this. it's a black box that can only be fixed by vendor.

my guess is it's a real doozy of a bug too.

Nice link explaining some basics.

You are right, it seems like a software bug in neither in the Application Processor Boot ROM running on the application processor (AP) or the sepOS running on Secure Enclave Processor. And since all is encrypted further troubleshooting seems foolish and only the vendor can fix this!

But there is not fix since months... maybe they are too busy creating fancy new slides for next Keynote?

Thanks for letting me know! Are you sure the disk decryption has been completed though? It's supposed to run in the background after turning it off:

"Decryption occurs in the background as you use your Mac, and only while your Mac is awake and plugged in to AC power. You can check progress in the FileVault section of Security & Privacy preferences."

https://support.apple.com/en-us/HT204837

BTW, the reason I didn't turn on FileVault on the new volume is that I this fix suggested by @d3cbgf a few pages back in this thread:

csrutil disable
bputil -nkcas

https://discussions.apple.com/thread/252437781?answerId=255944368022#255944368022)

...seemed to resolve the issue for me for a test period of at least 2-3 days.

This led me to suspect that it might be related to some low-level security stuff on M1 chips.

That's why I disabled FileVault. It was only a hunch though.

The only thing I know for sure is that reinstalling OS X on a new volume (Without FileVault enabled) solved it for me.

And since others seem to have tried reinstalling OS X without luck, I thought this might be the difference.

Good luck!

About a month ago, mine switched to a TimeOut error and I have not had another SOCD. Manifests in the same way. I looks like the issue may have been fixed with the latest Monterey update are reported in the link I attached below. I have not tested it as I have critical software that is not approved for 12.3.1 yet. A work around seems to be ejecting external devices at the topmost level in Disk Utility and/or restarting after ejecting a disk.

busy timeout[0], (60s): 'AppleAPFSMediaBS… - Apple Community

Hello, unclear of your answer.

Your Answer:

Steps taken with 2nd level support:

1. MAC OS REINSTALL.
2. MAC DISK ERASE AND REINSTALL FROM ICLOUD.
3. ISSUE ALSO HAPPENS IN GUEST MODE LOG IN.

Did this stop the problem? When 2nd level support. Reinstalled OS, etc

Are you still having the problem?

Thanks

I have a Mac mini 16Gb/256GB.

It has happened to me only once.

I have:

• 2 x displays connected. One on USB-C and one on HDMI.
• 1 x USB-C, with an anker 8-1 hub with a Logitech Receiver and an ElGato Wave:3 connected to it.
• 1 x USB-A, with an sabrent 4-1 USB-A hub with a Logitech HD 1080p webcam connected.
• 1 x USB-A, Samsung memory stick (Not SSD) with 256GB.
• 1 x Ethernet cable connected.
• No time machine enabled.
• I turn it off manually every night.

Got the same error than everybody else, just: "SOCD report detected: (AP watchdog expired)"

I hope this information helps.

There are some things that make this more likely to happen:

• Unpowered USB A hubs
• Plugging USB 3 drives into the USB C port through an adapter
• WD external drives

For example, I don't get this with my Seagate, but I do with my WD drive.

I wonder if monitors affect this? Some have unpowered hubs, which may do this. But what about the ones without hubs?

It seems that some people still get this without any of the above factors.

In my experience, the SOCD REPORT restart issue is related to USB devices, but is clearly more frequent with some than others.

Devices that I've seen cause this, from most frequent to least frequent.

1. Unpowered USB hubs
2. Monitors with unpowered USB hubs
3. Monitors
4. WD external drives
5. Other USB devices
6. ? no USB devices

I realize some folks are very distraught and can't figure out the cause of their crashes. The above is only to relate my understanding of what's happening, and there are those who have this issue with no devices.

For me, I've achieved over a month without a crash even though I have a Seagate external HD attached. I know when I reconnect my WD external drive, I'll have a crash within a couple of hours. My plan is to buy a powered USB3 hub so I can leave it attached.

I wish everybody here affected by this problem good luck.

Moi aussi. Just happened to me for the first time, and I've had this Mac Mini M1 for 4 or 5 months now. I had running:

• Youtube
• Chrome
• Safari
• Outlook
• Finder

I have a Seagate USB drive connected, and a powered USB hub with a Logitech webcam and a PreSonus Studio24C audio interface.

It went full green screen when I clicked within Finder to navigate to a different folder. Not coincidentally, I'm sure, Big Sur pushed an update this morning. I am now on 11.4. Before this update, it had never happened.

So I had the same issue just a few minutes ago. I have a Mac mini M1 with 16 GB of RAM. Had no problems for the last month. All the time I had the following devices connected:

• USB Microphone (Samson Meteor mic)
• unpowered USB-A-Hub
  • USB Mouse and Keyboard
  • Logitech USB Webcam
• USB-C Hub
  • Philips Full-HD Monitor via HDMI Port of the Hub
  • Creative Pebble V3 Speakers
• USB-C Sandisk Extreme external SSD 1 TB
• second Philips Full-HD Monitor via the HDMI Port of the Mac mini

The restart happend when watching a YouTube video in Firefox. Other apps running where Slack, Whatsapp Desktop and Zoom (no active video call, just idle).

Hopefully this is not a hardware error with the new chips...

going ahead with installing macOS Monterey beta. could introduce different issues, but worth a shot to see if SOCD random reboot has been fixed there.

also for reference of whats plugged into my mac mini 8/256:

• 4 port unpowered Anker usb hub (A7516011),
• Steelseries Apex Pro TKL (there is 1 usb port on the keyboard itself, so it actually uses 2 ports on the Anker hub)
• Yubikey 5 NFC is plugged into the USB port on the keyboard
• Steelseries Prism Cloth RBG mousepad plugged into Anker usb hub
• Glorious PC Gaming Race Model O Minus USB mouse plugged into Anker usb hub

Thunderbolt 1 has USB C to HDMI Cable Adapter powering 2nd monitor

Thunderbolt 2 has ACASIS Thunderbolt nvme (TBU401) with a 980 ssd

HDMI is just regular HDMI to HDMI

Ethernet is also being used

This leaves 1 USB port open. Otherwise, the IO on this device is fairly saturated. I have my eye on OWC's new Thunderbolt dock coming out too in case this issue persists.

Thanks! in MacOS Monterey B2 the releases notes says:

Endpoint Security

Known Issues

• When initializing a new EndpointSecurity client via es_new_client, a set of executable paths is automatically muted for a subset of AUTH event types to help reduce inadvertent negative impact to end users (for example, panics triggered by watchdogd due to clients not responding to AUTH events quickly enough). The set of muted paths and associated event types are inspectable using es_muted_paths_events. Although unmuting the AUTH events associated with these paths isn’t recommended, it’s possible to do so using es_unmute_path_events. (78405437)

Can be this the real solution?