Constant kernel panics after macOS High Sierra upgrade

MacbookAirUser1 wrote:

Hi BobHarris,

i have the same issue. Do you have any suggestions for me?

apfs error - Pastebin.com

Actually, I do NOT think you have the same original problem.

In your case, I think your anti-virus is messing with your system

1. com.sophos.nke.swi 9.6.52
2. com.sophos.kext.oas 9.6.53
3. com.avatron.AVExFramebuffer 3.0.1
4. com.avatron.AVExVideo 3.0.1

I do not know anything about avatron, but as it appears to be related to video, and your panic is in file system where anti-virus, such as Sophos like to insert kernel hooks, I strongly feel your problem is Sophos

I would the Sophos uninstall procedure (check their web site if you are not sure).

I would NOT install any 3rd party anti-virus. macOS does a good job all by itself

Please read "How does Mac OS X protect me?"

<http://www.thesafemac.com/mmg-builtin>

And Please read

<Effective defenses against malware and other threats>

If you want to run anything, then use MalwareBytes (written by a long time respected forum contributor)

<https://www.malwarebytes.org>

I am ONLY talking about the free option, where you manually run it if you suspect something, otherwise do not consume your Mac's memory and CPU resources having it continuously run for something that is unlikely to happen (again, because macOS does a good job).

Could you please post some of your panic reports?

Kernel Panic reports: Finder -> Go -> Go to Folder -> /Library/Logs/DiagnosticReports

<http://support.apple.com/kb/ht2546>

<http://support.apple.com/en-us/HT200553>

The panic report should have "panic" in the file name.

It might also be interesting if you post the EtreCheck output as a "Reply" to this thread

<https://discussions.apple.com/docs/DOC-6174> or <https://etrecheck.com>

Use the EtreCheck "Share" button to "Copy Report" (See the image below)

And then Paste in a "Reply" to this thread.

If, AND ONLY IF, you get the error:

"The message contains invalid characters"

then try posting to PasteBin.com, and give us a PasteBin URL link.

<http://pastebin.com/>

.

EtreCheck is a tool that helps Apple Support Community volunteers debug problems without any access to the troubled computers. Debugging problems can be a difficult task even when the machine is in front of you. Attempting it via a discussion forum is extremely difficult. EtreCheck is a great help that regards.

I'm running this on a Mac Pro 5.01 and have the same issues. Re-installed the system 4 times on a Kingston SSD, and it worked fine but after a while it panics after a reboot. What I've done so far:

- Reset PRAM

- Rebooted with -r (can't fix disk)

- Rebooted in s, en did a fsck. Disk appears to be fine

If I start from my other SSD on Sierra, the system boots fine. I am not able to repair the High Sierra disk though, when I try to repair the AppleAPFSMedia it always end up with:

"Storage system check exit code is 8"

Strange thing is, when I try to do a repair on the "Kingston" volume, disk utility crashes.

From my old Sun days I have some troubleshooting knowledge left, but I can't find the reason why this is happening.

For now I am back on my Sierra disk, which sometimes hangs, specially when I've been away for a while and try to log back in. Something I did not have in High Sierra.

Here's my pain log, seems to look a bit the same as from Nico.

Anonymous UUID: AC6B3A15-D350-995C-4801-B8BFFB89EA94

Tue Oct 10 14:33:21 2017

*** Panic Report ***

panic(cpu 10 caller 0xffffff801e98a611): Kernel trap at 0xffffff7fa1129158, type 14=page fault, registers:

CR0: 0x000000008001003b, CR2: 0x0000000000000020, CR3: 0x00000004592fc000, CR4: 0x0000000000002660

RAX: 0x0000000000000000, RBX: 0x0000000000000000, RCX: 0x0000000000000000, RDX: 0x0000000000000000

RSP: 0xffffff920bdebb50, RBP: 0xffffff920bdebb60, RSI: 0x0000000000000027, RDI: 0x0000000000000000

R8: 0xffffff8040a8e000, R9: 0x0000000000000001, R10: 0xffffff8041ca8cc0, R11: 0x0000000000000001

R12: 0xffffff803ed26680, R13: 0xffffff803ed26680, R14: 0xffffff7fa135c44c, R15: 0xffffff8041cc24e0

RFL: 0x0000000000010246, RIP: 0xffffff7fa1129158, CS: 0x0000000000000008, SS: 0x0000000000000010

Fault CR2: 0x0000000000000020, Error code: 0x0000000000000000, Fault CPU: 0xa, PL: 0, VF: 0

Backtrace (CPU 10), Frame : Return Address

0xffffff920bdeb610 : 0xffffff801e86d366

0xffffff920bdeb650 : 0xffffff801e998494

0xffffff920bdeb690 : 0xffffff801e98a429

0xffffff920bdeb710 : 0xffffff801e81f190

0xffffff920bdeb730 : 0xffffff801e86cd8c

0xffffff920bdeb860 : 0xffffff801e86cafc

0xffffff920bdeb8c0 : 0xffffff801e98a611

0xffffff920bdeba40 : 0xffffff801e81f190

0xffffff920bdeba60 : 0xffffff7fa1129158

0xffffff920bdebb60 : 0xffffff7fa10b62c8

0xffffff920bdebba0 : 0xffffff7fa08d6c9e

0xffffff920bdebc20 : 0xffffff7fa08ce700

0xffffff920bdebc70 : 0xffffff7fa10b7474

0xffffff920bdebcc0 : 0xffffff801ee77c9f

0xffffff920bdebd10 : 0xffffff801eed3b37

0xffffff920bdebd70 : 0xffffff801e945832

0xffffff920bdebdc0 : 0xffffff801e8725ee

0xffffff920bdebe10 : 0xffffff801e84fbdd

0xffffff920bdebe60 : 0xffffff801e862c6b

0xffffff920bdebef0 : 0xffffff801e9750fd

0xffffff920bdebfa0 : 0xffffff801e81f996

Kernel Extensions in backtrace:

com.apple.iokit.IOGraphicsFamily(517.17)[05FC87E8-B78E-319E-AF08-0EBDA16094CE]@ 0xffffff7fa08c0000->0xffffff7fa0905fff

dependency: com.apple.iokit.IOPCIFamily(2.9)[DF1517A2-32C4-328E-9890-03E6C546604A]@0xffffff 7f9f094000

com.apple.nvidia.driver.NVDAResman(10.2.4)[32AD415F-E50C-3AF3-861E-B49483F4B0A4 ]@0xffffff7fa10b3000->0xffffff7fa1398fff

dependency: com.apple.iokit.IOPCIFamily(2.9)[DF1517A2-32C4-328E-9890-03E6C546604A]@0xffffff 7f9f094000

dependency: com.apple.iokit.IONDRVSupport(517.17)[65CF8366-5909-3674-9557-075FE1439A25]@0xf fffff7fa0938000

dependency: com.apple.iokit.IOGraphicsFamily(517.17)[05FC87E8-B78E-319E-AF08-0EBDA16094CE]@ 0xffffff7fa08c0000

dependency: com.apple.AppleGraphicsDeviceControl(3.16.19)[35BE1077-5D56-3353-BFC5-F6026B931 F81]@0xffffff7fa0b52000

BSD process name corresponding to current thread: WindowServer

Mac OS version:

17A405

Kernel version:

Darwin Kernel Version 17.0.0: Thu Aug 24 21:48:19 PDT 2017; root:xnu-4570.1.46~2/RELEASE_X86_64

Kernel UUID: B84FDEFC-9081-35CE-8C51-25A9583AACDE

Kernel slide: 0x000000001e600000

Kernel text base: 0xffffff801e800000

__HIB text base: 0xffffff801e700000

System model name: MacPro5,1 (Mac-F221BEC8)

System uptime in nanoseconds: 77732882346

last loaded kext at 77537754827: com.apple.driver.AppleGraphicsDevicePolicy 3.16.19 (addr 0xffffff7fa14fb000, size 98304)

loaded kexts:

com.nvidia.NVDAStartupWeb 10.2.5

com.nvidia.CUDA 1.1.0

com.steelseries.ssenext.driver 1.6.4

com.apple.driver.AppleGraphicsDevicePolicy 3.16.19

com.apple.AGDCPluginDisplayMetrics 3.16.19

com.apple.driver.AppleHV 1

com.apple.iokit.IOUserEthernet 1.0.1

com.apple.driver.AudioAUUC 1.70

com.apple.iokit.IOBluetoothSerialManager 6.0.0f7

com.apple.driver.AppleUpstreamUserClient 3.6.4

com.apple.driver.pmtelemetry 1

com.apple.driver.AppleMCCSControl 1.5.3

com.apple.driver.AppleMikeyHIDDriver 131

com.apple.Dont_Steal_Mac_OS_X 7.0.0

com.apple.GeForceTesla 10.0.4

com.apple.driver.AppleHDAHardwareConfigDriver 280.12

com.apple.driver.AppleMikeyDriver 280.12

com.apple.driver.AppleTyMCEDriver 1.0.3d2

com.apple.driver.AGPM 110.23.24

com.apple.driver.AppleHDA 280.12

com.apple.AVEBridge 1.0.0

com.apple.nvidia.NVDAStartup 10.2.4

com.apple.driver.Intel82574LEthernet 2.7.2

com.apple.iokit.IOBluetoothUSBDFU 6.0.0f7

com.apple.driver.AppleLPC 3.1

com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0

com.apple.driver.AppleFIVRDriver 4.1.0

com.apple.driver.AppleOSXWatchdog 1

com.apple.driver.Apple_iSight 4.0.1

com.apple.driver.ACPI_SMC_PlatformPlugin 1.0.0

com.apple.filesystems.autofs 3.0

com.apple.filesystems.apfs 748.1.47

com.apple.driver.AppleTopCaseHIDEventDriver 127

com.apple.driver.AppleUSBTopCaseDriver 127

com.apple.iokit.SCSITaskUserClient 404

com.apple.driver.AppleFileSystemDriver 3.0.1

com.apple.filesystems.hfs.kext 407.1.3

com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1

com.apple.BootCache 40

com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0

com.apple.driver.AppleFWOHCI 5.5.8

com.apple.driver.AppleAHCIPort 329

com.apple.driver.AppleHPET 1.8

com.apple.driver.AppleRTC 2.0

com.apple.driver.AppleACPIButtons 6.1

com.apple.driver.AppleSMBIOS 2.1

com.apple.driver.AppleACPIEC 6.1

com.apple.driver.AppleAPIC 1.7

com.apple.driver.AppleIntelCPUPowerManagementClient 220.0.0

com.apple.nke.applicationfirewall 183

com.apple.security.TMSafetyNet 8

com.apple.security.quarantine 3

com.apple.IOBufferCopyEngineTest 1

com.apple.driver.AppleIntelCPUPowerManagement 220.0.0

com.apple.driver.AppleGraphicsControl 3.16.19

com.apple.iokit.IOTimeSyncFamily 600.15

com.apple.driver.AppleSSE 1.0

com.apple.iokit.IOSurface 209

com.apple.iokit.IOSerialFamily 11

com.apple.nvidia.driver.NVDAResman 10.2.4

com.apple.nvidia.classic.NVDANV50HalTesla 10.0.4

com.apple.nvidia.classic.NVDAResmanTesla 10.0.4

com.apple.AppleGPUWrangler 3.16.19

com.apple.AppleGraphicsDeviceControl 3.16.19

com.apple.driver.DspFuncLib 280.12

com.apple.kext.OSvKernDSPLib 526

com.apple.iokit.IONDRVSupport 517.17

com.apple.driver.AppleSMBusController 1.0.18d1

com.apple.driver.AppleHDAController 280.12

com.apple.iokit.IOGraphicsFamily 517.17

com.apple.iokit.IOHDAFamily 280.12

com.apple.iokit.IOAudioFamily 206.5

com.apple.vecLib.kext 1.2.0

com.apple.driver.AppleSMBusPCI 1.0.14d1

com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0

com.apple.iokit.IOFireWireIP 2.2.8

com.apple.driver.IOPlatformPluginLegacy 1.0.0

com.apple.driver.IOPlatformPluginFamily 6.0.0d8

com.apple.kext.triggers 1.0

com.apple.driver.AppleEffaceableStorage 1.0

com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 6.0.0f7

com.apple.iokit.IOBluetoothHostControllerUSBTransport 6.0.0f7

com.apple.iokit.IOBluetoothHostControllerTransport 6.0.0f7

com.apple.driver.AppleXsanScheme 3

com.apple.iokit.IOAHCIBlockStorage 301.1.2

com.apple.driver.AppleHSBluetoothDriver 127

com.apple.driver.IOBluetoothHIDDriver 6.0.0f7

com.apple.iokit.IOBluetoothFamily 6.0.0f7

com.apple.driver.AppleHIDKeyboard 203

com.apple.driver.AppleMultitouchDriver 1004.1

com.apple.driver.AppleInputDeviceSupport 1000

com.apple.driver.usb.IOUSBHostHIDDevice 1.2

com.apple.driver.usb.cdc 5.0.0

com.apple.driver.usb.networking 5.0.0

com.apple.driver.usb.AppleUSBHostCompositeDevice 1.2

com.apple.driver.usb.AppleUSBHub 1.2

com.apple.iokit.IOSCSIMultimediaCommandsDevice 404

com.apple.iokit.IOBDStorageFamily 1.8

com.apple.iokit.IODVDStorageFamily 1.8

com.apple.iokit.IOCDStorageFamily 1.8

com.apple.iokit.IONetworkingFamily 3.3

com.apple.filesystems.hfs.encodings.kext 1

com.apple.iokit.IOAHCISerialATAPI 267

com.apple.iokit.IOFireWireFamily 4.6.8

com.apple.driver.AppleUSBMergeNub 900.4.1

com.apple.driver.usb.AppleUSBXHCIPCI 1.2

com.apple.driver.usb.AppleUSBXHCI 1.2

com.apple.iokit.IOAHCIFamily 288

com.apple.driver.usb.AppleUSBEHCIPCI 1.2

com.apple.driver.usb.AppleUSBUHCIPCI 1.2

com.apple.driver.usb.AppleUSBUHCI 1.2

com.apple.driver.usb.AppleUSBEHCI 1.2

com.apple.driver.usb.AppleUSBHostPacketFilter 1.0

com.apple.iokit.IOUSBFamily 900.4.1

com.apple.driver.AppleUSBHostMergeProperties 1.2

com.apple.driver.AppleEFINVRAM 2.1

com.apple.driver.AppleEFIRuntime 2.1

com.apple.iokit.IOHIDFamily 2.0.0

com.apple.iokit.IOSMBusFamily 1.1

com.apple.security.sandbox 300.0

com.apple.kext.AppleMatch 1.0.0d1

com.apple.iokit.IOBufferCopyEngineFamily 1

com.apple.driver.DiskImages 480.1.2

com.apple.driver.AppleKeyStore 2

com.apple.driver.AppleUSBTDM 439

com.apple.driver.AppleMobileFileIntegrity 1.0.5

com.apple.iokit.IOUSBMassStorageDriver 140

com.apple.iokit.IOSCSIBlockCommandsDevice 404

com.apple.iokit.IOSCSIArchitectureModelFamily 404

com.apple.iokit.IOStorageFamily 2.1

com.apple.driver.AppleCredentialManager 1.0

com.apple.driver.KernelRelayHost 1

com.apple.iokit.IOUSBHostFamily 1.2

com.apple.driver.usb.AppleUSBCommon 1.0

com.apple.driver.AppleBusPowerController 1.0

com.apple.driver.AppleSEPManager 1.0.1

com.apple.driver.IOSlaveProcessor 1

com.apple.iokit.IOReportFamily 31

com.apple.driver.AppleFDEKeyStore 28.30

com.apple.driver.AppleACPIPlatform 6.1

com.apple.driver.AppleSMCRTC 1.0

com.apple.driver.AppleSMC 3.1.9

com.apple.iokit.IOPCIFamily 2.9

com.apple.iokit.IOACPIFamily 1.4

com.apple.kec.pthread 1

com.apple.kec.Libm 1

com.apple.kec.corecrypto 1.0

EOF

I managed to get my high sierra disk to boot again.

I've move all my *.kext file from /Library/Extensions/ to an other directory.

My system started up just fine and everything seems to work as it should, Although I would believe that it would need the kext files I have removed.

The /Library/Extensions stays empty though, I am not sure if I can figure out which *.kext was causing the system to panic. As far as I know they should be in /System/Library/Extensions.

What I don't understand is that the timestamps have not changed, which I would expect if the system fails after a reboot on a (corrupt) kext driver.

Here's my list in case someone wants to know, only the GeForce and NVDA kext files are in my /System/Library/Extensions directory.

In addition to Bob's advice, you may also run the diagnostic tool Etrecheck and post its report here.

It may well

bernadettefromleiden wrote:

I have Finder, but no option to Go -> Go to Folder -> /Library/Logs/DiagnosticReports.

Sure you do.

This brings up a window, where you are supposed to type the folder path.

RJHMUSIC,

We need to see the panics you are getting to be helpful. As this is a user-to-user technical support fourm, we need information.

Please post the most recent kernel panic report(s). If you have more than one, it would be useful to see a few, as whether they are consistant or change will give us useful information.

Kernel Panic reports: Finder -> Go -> Go to Folder -> /Library/Logs/DiagnosticReports

<http://support.apple.com/kb/ht2546>

<http://support.apple.com/en-us/HT200553>

The panic report should have "panic" in the file name.

It would also be useful to see what, if any, 3rd party additions have been installed. This too can help diagnose your system.

Please post the EtreCheck output as a "Reply" to this thread

<https://discussions.apple.com/docs/DOC-6174> or <https://etrecheck.com>

Use the EtreCheck -> Edit -> Copy Report (See the image below)

.

And then Paste the report as a "Reply" to this thread.

If, AND ONLY IF, you get the error:

"The message contains invalid characters"

then try posting to PasteBin.com, and give us a PasteBin URL link.

<http://pastebin.com/>

.

EtreCheck is a tool that helps Apple Support Community volunteers debug problems without any access to the troubled computers. Debugging problems can be a difficult task even when the machine is in front of you. Attempting it via a discussion forum is extremely difficult. EtreCheck is a great help that regards.

It is possible you have a hardware issue, but we can only look at the information you give us, and then may recommendataions.

Keep your virtual machine image, and just temporarily remove VirtualBox. If the system still failed, it is NOT VirtualBox and you can reinstall and continue to use your saved virtual image.

And if having NO 3rd party kernel extensions and it still panics, you should file a bug report with Apple

BugReporter (Free ADC (Apple Developer Connection)) account needed for BugReporter

<http://bugreporter.apple.com>

Anyone can get a free ADC account at:

<https://developer.apple.com/register/index.action>

Reply to chetan_9007

I suspect this is an APFS bug. I suggest you file a bug report with Apple

BugReporter (Free ADC (Apple Developer Connection)) account needed for BugReporter

<http://bugreporter.apple.com>

Anyone can get a free ADC account at:

<https://developer.apple.com/register/index.action>

upgraded RAM with aftermarket

Replace the old RAM and test.

If it doesn't panic, you got bad RAM. You can try testing with either the built-in Apple Diagnostics or Rember: http://www.kelleycomputing.net/Rember

Have your previous repair receipt information, or case number when you next interact with Apple.

You can try the Genius Bar, as it cannot hurt. Since you have one failed repair, if the first level of Genius Bar does not want to replace, then ask to speak to a manager. If that is not satisfactory call Apple

<Contact - How to Contact Us - Apple>

Again, if no satisfaction, keep asking to speak to the next higher level of support.

But I suggest you always be polite, just insistent.

OK, lets start with the 3rd party RAM. This is just speculation, but 3rd party RAM has often been involved in kernel panics. HOWEVER, the kernel panic is not a traditional memory related kernel panic, but I do not see anything else obvious in your panic report.

Memory Module: BANK 0/DIMM0, 4 GB, DDR3, 1600 MHz, 0x859B, 0x435435313236344246313630422E43313646

Memory Module: BANK 1/DIMM0, 4 GB, DDR3, 1600 MHz, 0x80AD, 0x484D54333531533643465238432D50422020

I'm not sure if they are both 3rd party RAM, or if it is just one of them. But the very long hex number at the end of each line is not identical which indicates they are from different vendors.

You could try running Rember overnight to see if it finds anything

Rember

<http://www.kelleycomputing.net/rember/>

.

Quit as many apps and background tasks as you can (such as menu bar items) so more RAM is available for testing. Booting into Safe mode <http://support.apple.com/kb/ht1564> can also free up more RAM for testing, by not loading any 3rd party additions you may have installed.

.

Set Loops: [X] Maximum

and run overnight

Had the same problems. Turns out for me it where Chrome plugins (trusted ones) in combination with High Sierra!

Never ever had any problems with Sierra and never had any kernel panic in four years on my macbook.

Turns out it caused problems before:

https://www.reddit.com/r/osx/comments/55rcuk/google_chrome_causing_a_kernel_pani c/

https://www.tonymacx86.com/threads/opening-google-chrome-causes-instant-kernel-p anics.210265/

https://discussions.apple.com/thread/6631528

https://productforums.google.com/forum/#!topic/chrome/NcKFPnppV_s

Maybe it's even the hardware-accelerated-css which kills the GPU...

https://apple.stackexchange.com/questions/285146/gpu-panic-cpp-143-macos-sierra- 10-12-5-stability-issues-and-spontaneous-restarts/287511

bernadettefromleiden wrote:

I have noticed that I have no kernel panic when I am connected with the internet. When my MacBook Air is nog able to find my personal hotspot, my laptop goes in kernel panic. The moment my laptop finds my personal hotspot, everything is ok. Also, my wifi at home: no problem. So apparently it seems to have something to do with a internet connection...

It would be interesting to see the kernel panic reports

Kernel Panic reports: Finder -> Go -> Go to Folder -> /Library/Logs/DiagnosticReports

<http://support.apple.com/kb/ht2546>

<http://support.apple.com/en-us/HT200553>

The panic report should have "panic" in the file name.

RJHMUSIC wrote:

I was told at the Apple Store tonight that I probably will not be able to downgrade the OS to Sierra because of the firmware in the new machine.

It's been the case for literally decades that you cannot downgrade the OS of a machine past what originally shipped on it.

If you're still within your return period, you can simply return your new machine for a full refund:

Returns & Refunds - Shopping Help - Apple

If your issues are ones the Apple Store has helped you with before and has failed to solve, speaking to a manager may result in them allowing the return anyway.

The only 3rd party kernel extension you have is

com.malwarebytes.mbam.rtprotection 3.2.36

While the long time forum contributers often recommend MalwareBytes (as the Mac verison was written by a long time forum contributor), it is still a kernel extension, and as such can get into trouble when a new macOS version is released.

I would suggest uninstalling MalwareBytes for now, and see if the problems continue

<https://support.malwarebytes.com/docs/DOC-1928>

Since the only current forms of malware affecting macOS are ones where the user is tricked into installing it, you can always re-install MalwareBytes after you have installed something to make sure whatever you installed in not carrying a malware side-package.

If removing MalwareBytes does not stop the system panics, you might consider whether your 3rd party RAM is causing problems.

You could run

Rember

<http://www.kelleycomputing.net/rember/>

.

Quit as many apps and background tasks as you can (such as menu bar items) so more RAM is available for testing. Booting into Safe mode <http://support.apple.com/kb/ht1564> can also free up more RAM for testing, by not loading any 3rd party additions you may have installed.

.

Set Loops: [X] Maximum

and run overnight

You could also move the 8GB DIMMs into the slots currently used by the 2GB DIMMs, and put the 2GB DIMMs in the previous 8GB DIMM slots.

You could also try removing the DIMMs one at a time to see if the problem goes away.