Built-in ethernet vanished

I *just* hit this after rebooting.

So apparently the version of the kernel extension for the built-in ethernet driver (AppleBCM5701Ethernet.ext) in OS X 10.11.3 has been added to the blacklist by Apple (AppleKextExcludeList.kext). Specifically versions lower than 10.2.0 have been blacklisted and version 10.1.12 is the one included in OS X 10.11.3.

The blacklist is dynamically pulled by OS X (it's not part of a system update) and I'm not sure what the trigger is exactly. The mod date on the bad AppleKextExcludeList.kext for me was Feb 24. The "good" one is from Nov 12.

I fixed this (probably temporarily) by doing the following:

1. Get the old AppleKextExcludeList.kext from Time Machine Backup and put it somewhere on your hard drive. OS X won't allow you to overwrite it when booted normally.
2. Boot into Recovery mode and overwrite the new /Volumes/<your boot volume>/System/Library/Extensions/AppleKextExcludeList.kext with the old.
3. Purge your kext cache. (kextcache -invalidate /Volumes/<your boot volume>)
4. Reboot back into normal OS X.

If and when OS X pulls the newer AppleKextExcludeList.kext, we'll be back to square one. Hopefully Apple will realize the mistake here soon.

Here's more direct instructions...

1. Download the old exclude list kext from https://www.dropbox.com/s/a9ttv4fy7zl2vtf/AppleKextExcludeList.kext.tgz?dl=0
2. Remember where you put it! Also note the name of your boot volume, the one that defaults to "Macintosh HD".
3. Boot into Recovery mode. Do this by rebooting and holding Command+R until the Apple logo appears.
4. Go to the Utilities dropdown in the menu bar, open Terminal.
5. Do this, replace <boot volume> with your boot volume name from step 2, the quotes are important if there's a space in it (also remember you can list files in your present directory by using ls -a:

   cd "/Volumes/<boot volume>"

   Example: cd "/Volumes/Macintosh HD"
6. Overwrite the newer broken kext with the one you downloaded.

   tar -xvzf "<location of AppleKextExcludeList.kext.tgz>"

   Example: tar -xvzf "Users/matt/Downloads/AppleKextExcludeList.kext.tgz" A couple of things to note here: if you put it in a folder off of your home directory, by default Downloads, you'll need to prepend Users/<username> to it. Notice there's no leading slash, that's because you're working with a location relative to the directory you changed (cd) to earlier. Again, quotes are required if there's a space in any of the path name.
7. Reboot into normal mode (just typing: reboot) and your ethernet should work again.

Final note, while I definitely don't recommend downloading random kexts off the Internet, kexts are now signed and only authentic ones are loaded by default by OS X during a normal boot so the risks are minimal.

Hi Daniel,

I had no idea that Apple was pushing out updates without my knowledge (or permission).

The setting exists in System Preferences.

This type of updates can be disabled by unchecking 'Install system data files and security updates' at 'App Store' pane.

My WiFi is working so followed the instructions three times and still no ethernet.

When I enter this command in Terminal sudo softwareupdate --background

and then try to QUIT Terminal I get this message

But there is no way to enter my password. Where do I enter it? Trying to type my password where the key symbol is produces no type.

So I try to QUIT Terminal thinking I'll be given the typical password dialog and get this message:

I hit CLOSE and restart the Mac and still no ethernet.

I'm not a Terminal expert, obviously. What am I doing wrong?

voxkenny -- following your lead I typed in my password (with no type appearing) and got this message in Terminal:

That suggests something was happening -- a "scan" for software updates?

And I made sure these boxes are checked in the App Store preference pane to allow updates:

I quite Terminal and restarted and still no ethernet.

Does anyone know how long it takes the computer to "scan" for updates and download the needed 3.28.2 extension?

@Matt Kulka: Thank you so much for this. I would have never in 1,000 years figured this out on my own, but it did fix the issue for me. I am eternally grateful!

Now hopefully Apple will fix this so future updates don't repeat this debacle. Thanks again, and take care!

Oh neat, somebody found the package for the old kext. Yeah, best bet is to just download that and install it.

http://swcdn.apple.com/content/downloads/60/61/031-44426/436eok9yeg31dav6ro4h1zf y5lkrw3v1oe/AppleKextExcludeList_10_11.pkg

Then just double click it and install it to your boot volume like you would any other installer and reboot.

Apple has now released a version 3.28.2 that will install over the bad extension.

The link to the update:

http://swcdn.apple.com/content/down...n0573nt31ifb45/AppleKextExcludeList_10_11. pkg

just install and reboot your computer.

hope this will help.

I want to add that the problem manifests itself in a very weird way. The interface says it's "Unplugged" in System Preferences, but you still get a link light on your switch. That's all most people will probably see. If you dig deeper, you notice that ifconfig says en0 doesn't exist and in the Console messages you'll eventually find that the kernel extension is in the exclude blacklist as noted in the second post in this thread. Most people would never find that.

I saved an older version of the AppleKextExcludeList from time machine onto my desktop but I don't understand how to fix the problem in Recovery mode. I've never had to use Recovery Mode and I understand if you can't or don't want to explain to someone unfamiliar with it. Thanks for your time and consideration.

Hi!

Thanks for the solution Matt. I don't have a Time Machine backup neither the ability maybe to repair, so when will Apple solve this? Is there been before this kind of issues? I mean I can connect to the Internet through the wifi, but moving bigger files to a NAS it's going to be quite slow.

Thanks for your time,

Marc

I found some more info: https://www.reddit.com/r/apple/comments/47tfos/warning_software_update_03151913_ breaks_ethernet/

Looks like a secret update, hopefully they will push a new one with the correction soon.