SOCD report detected: (AP watchdog expired)

Mac Mini M1 16GB keeps crashing and then restarting randomly on all applications with following error message:

I was asked by Apple second level support to provide details of the crash reports logged when it happens. 

It is [SOCD report detected: (AP watchdog expired)


SOCD report detected: (AP watchdog expired)


Even when idle. 


Steps taken with 2nd level support:

  1. MAC OS REINSTALL.
  2. MAC DISK ERASE AND REINSTALL FROM ICLOUD.
  3. ISSUE ALSO HAPPENS IN GUEST MODE LOG IN.


Mac mini, macOS 11.2

Posted on Feb 11, 2021 2:23 AM

Reply
Question marked as Top-ranking reply

Posted on Feb 28, 2021 1:01 AM

Apple 2nd level support seemed to think it was due to external hard drive issues. They asked me to test without drive connected.


can confirm now that the SOCD crash would only occur with My external USB A Western Digital Hard drive physically connected. After disconnecting it has not happened again, so far. After 5 days.


do you all have external drives connected?

365 replies

Apr 11, 2021 11:24 AM in response to magic100

I have two external drives, both USB 3.0. The Seagate drive remains attached and works fine.

My WD drive must be disconnected after use, or it causes crashes.


Somebody told me to get a powered USB 3 hub (available for under $20 on Amazon) to fix this problem. Just plug it into a USB 3 port on the Mini and then plug both drives into it. I haven't tried that yet.

May 24, 2021 10:59 PM in response to dtrombi

Yes so you did have a usb device connected in this case a Monitor.


The SOCD REPORT restart issue is only for external USB devices.

Doesn’t matter what they are, could be a storage device, hub, monitor, dac, webcam.

Can be Plug Powered or USB Powered.


Other crashes are not to do with SOCD REPORT and can happen regardless of device connection.



Jul 4, 2021 8:28 AM in response to MarkMcInnis

going ahead with installing macOS Monterey beta. could introduce different issues, but worth a shot to see if SOCD random reboot has been fixed there.


also for reference of whats plugged into my mac mini 8/256:


  • 4 port unpowered Anker usb hub (A7516011),
  • Steelseries Apex Pro TKL (there is 1 usb port on the keyboard itself, so it actually uses 2 ports on the Anker hub)
  • Yubikey 5 NFC is plugged into the USB port on the keyboard
  • Steelseries Prism Cloth RBG mousepad plugged into Anker usb hub
  • Glorious PC Gaming Race Model O Minus USB mouse plugged into Anker usb hub


Thunderbolt 1 has USB C to HDMI Cable Adapter powering 2nd monitor

Thunderbolt 2 has ACASIS Thunderbolt nvme (TBU401) with a 980 ssd


HDMI is just regular HDMI to HDMI


Ethernet is also being used


This leaves 1 USB port open. Otherwise, the IO on this device is fairly saturated. I have my eye on OWC's new Thunderbolt dock coming out too in case this issue persists.





Jul 4, 2021 2:00 PM in response to d3cbgf

Thanks! in MacOS Monterey B2 the releases notes says:


Endpoint Security

Known Issues


  • When initializing a new EndpointSecurity client via es_new_client, a set of executable paths is automatically muted for a subset of AUTH event types to help reduce inadvertent negative impact to end users (for example, panics triggered by watchdogd due to clients not responding to AUTH events quickly enough). The set of muted paths and associated event types are inspectable using es_muted_paths_events. Although unmuting the AUTH events associated with these paths isn’t recommended, it’s possible to do so using es_unmute_path_events. (78405437)


Can be this the real solution?

Aug 24, 2021 4:20 AM in response to kode54

From what I read on the Apple site that d3cbgf linked in his post and from what is written in the panic log file, I don‘t think this issue is a kernel panic (KP) of macOS. In case of a kernel panic we would have seen a typical function call backtrace of the kernel in the panic log, but we don‘t see this here.


It looks more that the secure enclave processor or the application processor (they both work close together on the SoC) have a kind of „panic“. As Apple it self points out in the linked site these are two processors that are completely independent from the CPU processors (ARM) where macOS and the kernel is running on. On the SoC runs its own operating system called sepOS and I think this OS have a „panic“ for whatever reason.


They point out a few „reset“ events when SoC needs to restart (and maybe macOS too, since secure enclave seems very important for its security), but it could be not all "reset" reasons are mentioned on the linked site. These are the mentioned „reset“ reasons as far as I understand them:

  • a Signature failure during booting of sepOS
  • Power and clock monitors of SoC detect an illegal operating point of voltage or frequency 
  • Memory Protection Engine in SoC detect an memory authentication error


I found the mentioned power and clock monitors interesting that supervise the voltage and frequency of the SoC to prevent external attacks of the SoC. I wonder if some external USB devices, like the very often by users here reported connected external USB devices, could have a negative impact to the voltage of the power rail and if the power monitor misinterprets this as an external attack and trigger this reset? But without any schematics and an expert expert analysing them, we will not know this.


Could be also a bug in sepOS that leads to this also mentioned memory authentication error or there is a bug in the way macOS communicate with the SoC over the I2C bus that leads to this memory authentication error? In the end I have no idea what the reason(or reasons) is that is causing this SoC reset.


Only the vendor can analyse this issue deeper and find the exact reason and hopefully will fix it.

Dec 13, 2021 11:59 PM in response to magic100

After upgrading to Monterey I've yet to see this problem on my Mac Mini M1 16GB/1TB.


I have a WD Blue NVMe 1TB external drive connected at all times. I also have a USB 3.1 Hub, and four monitors hooked up, two by Display Link adapters.


The only thing I did was uninstall a driver for a Plantronics headset, then all my processes running were M1 and zero were Intel in Rosetta mode. That's when I noticed no more crashes, which would happen maybe once or twice a week or month.

Apr 29, 2022 3:34 PM in response to magic100

About a month ago, mine switched to a TimeOut error and I have not had another SOCD. Manifests in the same way. I looks like the issue may have been fixed with the latest Monterey update are reported in the link I attached below. I have not tested it as I have critical software that is not approved for 12.3.1 yet. A work around seems to be ejecting external devices at the topmost level in Disk Utility and/or restarting after ejecting a disk.

busy timeout[0], (60s): 'AppleAPFSMediaBS… - Apple Community


Oct 20, 2022 1:01 PM in response to Boonman1979

I had the same problem with random reboots on M1 Mini, SOCD report and USB C failed port. Apple products are no longer reliable. I have owned many Mac computers since the late 80's and have never purchased the extended warranty because they never failed. I took the machine to the local Apple store. The managers said if I was even one day past the 1 year warranty, there would be a cost for any repairs. They told me they could replace the logic board for $450 or I could buy a new machine since I was a month past the 1 year warranty. Apple knows the M1 mini has had defective logic boards but still plays hardball past the warranty. Basically, you must spend more money for an extended warranty when buying the computer because Apple computers are not reliable like they used to be. Lesson learned. Buy something else or plan to spend more money up front on the chance that an Apple product will fail, and they will fail. Terrible customer service and company policy.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

SOCD report detected: (AP watchdog expired)

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.