How to fix kernel panics after installing OS X updates

PanicReporterIconXKernel panics in OS X occur primarily because your Mac has faulty or incompatible hardware, or because you are using incompatible or poorly written kernel extension drivers. With either of these situations, the core system software component called the “kernel” may run into a fault from which it cannot recover, which will bring down the entire system. Kernel panics are relatively rare in OS X, but may occur if a piece of hardware has gone bad, or you introduce a bug by updating system software or third-party kernel extensions. If this happens, there are usually a couple of quick approaches you can take to overcome the issue.

Safe Mode

The primary cause for kernel panics in OS X is incompatible third-party kernel extension software. Since the core services in OS X require no third-party driver software, if you experience a panic, then first reboot your Mac into Safe Mode by holding the Shift key down when you hear the boot chimes. This will load only essential OS X software, and indicate so by displaying “Safe Mode” in the menu bar (your Mac will also run notably slower and have limited capabilities).

If your Mac boots, Safe Mode will ensure it remains remains stable while you investigate the cause for the problem. This is especially true if you run into repeated kernel panics. When in Safe Mode, your best approach for determining the cause of the panic is to look at the panic report. This may appear in an automatic popup window, but can also be found under the System Diagnostic Reports section of the Console utility, containing the date and time of the panic in its title and ending with the suffix “.panic” in its name.

These panic reports have three basic areas of importance associated with them:

1. The Backtrace

This section shows the memory addresses for the processes were active when the panic occurred, and will look like the following, with part of this section being a list of the relevant kernel extensions in the backtrace. This last part is the most important, which suggests the driver that is causing the issue:

Backtrace (CPU 0), Frame : Return Address
0xffffff912be2b9c0 : 0xffffff902792bca1
…
0xffffff912be2bfb0 : 0xffffff9027a126b4
      Kernel Extensions in backtrace:
         com.visicom.ManyCam.VideoDevice.driver(3.0.11)[AD731C8A-1682-30D4-8817-417E6C85 BA32]@0xffffff4fb9176000->0xffffff4fb71b8fff
            dependency: com.apple.iokit.IOVideoFamily(1.2.1)[399D9EDD-0E6F-3C83-B60F-98214134FCD0]@0xffffff4fb7178000
            dependency: com.apple.iokit.IOStreamFamily(1.1.0)[A67D63E8-0326-34ED-8E53-E75567C1BEC4]@0xffffff4fb716c000

In here, the line in red is the most recent Kernel Extension loaded, which suggests this is the root of the problem.

2. The process name

This section lists the process that caused the panic, which may indicate a specific program, or the “kernel_task” process itself, which is a more generic way of suggesting a Kernel Extension is involved. In general kernel_task or another process that is directly associated with kernel extensions (such as socketfilterfw for the firewall) will be listed:

BSD process name corresponding to current thread: kernel_task

3. The last loaded drivers

A final part of the panic report will list the most recently loaded drivers, which again can help confirm a specific Kernel Panic is involved. In this case, the last loaded extension is the one mentioned in the backtrace, suggesting it is the incompatible driver causing the problem here:

System uptime in nanoseconds: 12511541631
last loaded kext at 12744433883: com.visicom.ManyCam.VideoDevice.driver 3.0.10 (addr 0xffffff4fb9176000, size 204800)
loaded kexts:
com.visicom.ManyCam.VideoDevice.driver 3.0.10
com.apple.iokit.IOUserEthernet 1.0.1

It is useful to keep in mind that the driver or software associations in section do not mean they are at fault, but rather are the software that was perhaps included in triggering the fault in the process and corresponding kernel extensions in the backtrace. Often this is the same driver, but sometimes the associated driver is listed a few lines down. For instance, if Apple’s firewall drivers are crashing, you might see a driver such as that for the popular Little Snitch firewall software, or Parallels Desktop, or other software, listed in this area. This suggests the loading of one or more of these packages was involved with the panic.

Remove Faulty Software

Kernel panics may happen periodically on a healthy Mac for odd and rare reasons, so going about fixing them is not recommended unless you are experiencing regular panics. This is especially true when they occur in stereotyped conditions, like when launching a specific program.

To address most kernel panic situations, when in Safe Mode and with the faulty third-party software identified, you can look into uninstalling it either by contacting the developer, or by running a provided uninstallation program that may accompany the software. While you can attempt to manually remove third-party kernel extensions from your Mac, doing so is a more brute-force approach that should be taken as a last resort. Also note that in this approach, you should only consider removing third-party software, and not any core OS X components.

While removing just the kernel extension components from a third-party software package will likely cause problems with running that software, it should not affect how OS X loads, and should ultimately improve any problems you are seeing with this software package. If this gets the panics under control, then you can go about reinstalling, updating, or removing the faulty software.

You can get a quick and crude look a what third-party kernel extensions are on your Mac, by running the following two commands in the Terminal (run each separately):

kextstat | grep -v apple
kextfind -i -not -b -s com.apple

Kernel Extensions will be located primarily in the following two directories on your Mac:

  • Macintosh HD > Library > Extensions
  • Macintosh HD > System > Library > Extensions

With the software uninstalled, you can now try rebooting normally to see if the problem persists.

Managing faulty hardware

If kernel panics will occur from loading Apple-provided extensions and other core system software, for the most part this means either another third-party software package is to blame, or that you have hardware faults at hand. This latter point is especially true if you see graphics-related extensions in the backtrace, or those for other hardware components (hardware sensor drivers, networking devices, etc.).

If you suspect hardware-related problems, then you can try several things to test the situation a little further. Naturally Safe mode is a good start, but this only limits the system so it will run stably, and is a difficult way to diagnose hardware problems as opposed to software-related issues.

  1. Run Apple’s hardware tests — Restart your Mac with the D key held to load Apple’s hardware tests (hold Option-D to force-load these from the Internet). You can also use tools like Rember or memtest to run relatively thorough memory testing routines on your Mac’s RAM.
  2. Install OS X to an external drive — Apple’s raw OS X software with no modifications should run any supported Mac hardware just fine, so you can test this by installing a fresh copy to an external drive and then booting to that drive. If OS X loads and runs fine from this drive, then you can likely rule out hardware problems.

Finally, if you have any third-party hardware installed or attached to your Mac, even if it is an upgrade like a new hard drive or more RAM, then consider investigating it. For RAM, you can run memory tests, swap out the replacement with your old RAM modules, or even try new modules (most have lifetime warranties against defects). The same goes for hard drives, though this can be somewhat tested using a secondary drive for a fresh OS X installation. Also consider checking any external device you have attached to your Mac via USB, Firewire, Thunderbolt, or any other hardware connection.

Managing drive formatting

One cause for kernel panics that can be relatively hidden is if your boot drive is failing. Anything from faulty sectors to firmware and controller faults with storage hardware can prevent OS X from loading necessary software or configurations, and thereby cause a panic, or hang. Unfortunately, OS X includes minimal options for thoroughly checking your hard drive, so you will have the following options for testing:

  1. Thoroughly repartition and format your drive, followed by restoring your Mac from a recent backup.
  2. Use third-party drive diagnostics software for running sector scans and checks.
  3. Take your Mac in to an Apple Store for testing.

This last point will be the final step for managing any ongoing kernel panics, especially if you cannot seem to find the cause in hardware. If the hardware in your Mac is faulty, or the drive is failing, then you will need to have the system serviced.

12 thoughts on “How to fix kernel panics after installing OS X updates”

  1. FixMaX

    If only we had a tool like Conflict Catcher for Mac OS X…
    http://en.wikipedia.org/wiki/Conflict_Catcher

    Why nobody has done it yet amazes me. Could make millions!

  2. Bruce Kay

    It’s not a coincidence you used the Manycam kext as an example causing a kernal panic. Apple has identified this as a cause of panics or restarts after installing 10.10.3 and recommends its removal. They go so far as providing instructions for this at: https://support.apple.com/en-us/HT6648. I’ve had about 4 unexplained restarts and a kernel panic and plan to remove this kext as soon as possible.

  3. HaX

    Three Kernel panics since installing Mac OS X 10.10.3 (14D136) on 16th April 2015. The “Console – System Diagnostic Reports” shows three “.panic” entries corresponding to the three kernel panics (26th April, 1st May and 8th May) as shown below.

    Ho to fix it? Thanks.

    ———————————————————————————————————————————–
    Kernel Extensions in backtrace:
    com.apple.iokit.IOAcceleratorFamily2(156.14)[BE7D765B-49C1-34F9-B75E-3EAF8A4062A3]@0xffffff7f82e47000->0xffffff7f82eb5fff
    dependency: com.apple.iokit.IOPCIFamily(2.9)[52E715FC-521D-3869-B2EA-5228FA4BEA34]@0xffffff7f81324000
    dependency: com.apple.iokit.IOGraphicsFamily(2.4.1)[82EAD591-67E3-39CB-A232-A8095CA30E92]@0xffffff7f81dbb000
    com.apple.driver.AppleIntelHD4000Graphics(10.0.6)[51B5D3C1-1319-3470-877F-B988299234BF]@0xffffff7f82ec4000->0xffffff7f82f1ffff
    dependency: com.apple.iokit.IOSurface(97.4)[A4AE35B7-0C17-38F2-AD0D-A4C4B40196FB]@0xffffff7f81c45000
    dependency: com.apple.iokit.IOPCIFamily(2.9)[52E715FC-521D-3869-B2EA-5228FA4BEA34]@0xffffff7f81324000
    dependency: com.apple.iokit.IOGraphicsFamily(2.4.1)[82EAD591-67E3-39CB-A232-A8095CA30E92]@0xffffff7f81dbb000
    dependency: com.apple.iokit.IOAcceleratorFamily2(156.14)[BE7D765B-49C1-34F9-B75E-3EAF8A4062A3]@0xffffff7f82e47000
    ———-
    com.apple.iokit.IOGraphicsFamily(2.4.1)[82EAD591-67E3-39CB-A232-A8095CA30E92]@0xffffff7fa29bb000->0xffffff7fa29f5fff
    dependency: com.apple.iokit.IOPCIFamily(2.9)[52E715FC-521D-3869-B2EA-5228FA4BEA34]@0xffffff7fa1f24000
    ———-
    Nothing shown here for third kernel panic.
    ———————————————————————————————————————————–
    BSD process name corresponding to current thread: com.apple.WebKit
    ———-
    BSD process name corresponding to current thread: WindowServer
    ———-
    BSD process name corresponding to current thread: DLStaged
    ———————————————————————————————————————————–
    last loaded kext at 95881643661: com.apple.filesystems.smbfs 3.0.1 (addr 0xffffff7f81762000, size 393216)
    last unloaded kext at 95986334190: com.apple.driver.AirPort.Brcm4331 800.20.24 (addr 0xffffff7f82765000, size 2043904)
    ———-
    last loaded kext at 621072372895: com.apple.filesystems.smbfs 3.0.1 (addr 0xffffff7fa400a000, size 389120)
    last unloaded kext at 84983883424: com.apple.driver.AirPort.Brcm4331 800.20.24 (addr 0xffffff7fa3365000, size 2043904)
    ———-
    last loaded kext at 112794591021120: com.apple.driver.AppleUSBAudio 295.23 (addr 0xffffff7f8d2af000, size 315392)
    last unloaded kext at 112855962551933: com.apple.driver.AppleUSBCDC 4.3.3b1 (addr 0xffffff7f8d274000, size 16384)
    ———————————————————————————————————————————–

    1. HaX

      Also, in all three cases, a lot of “com.apple” loaded kexts: lines and these three ones:

      loaded kexts:
      com.eltima.ElmediaPlayer.kext 1.0
      com.AmbrosiaSW.AudioSupport 4.1.4
      at.obdev.nke.LittleSnitch 4240

      Any idea to fix it will be most welcome.

      1. Topher Kessler Post author

        It appears you may have a graphics-related issue, as the kernel panic suggests the last loaded Kext was Apple’s video driver. You might try uninstalling the Ambrosia and Eltima software packages as any kernel extension may be responsible for these issues. If uninstalling these does not work, then the issue may be a hardware-related problem. What is your Mac’s model number? There are some systems that have had ongoing graphics issues, so it may be helpful to keep these in mind.

  4. HaX

    Thanks for the quick reply. I will try as you say and report here. The three kernel panics arose while surfing the web with Safari or playing videos with VLC (latest versions for all).

    To start, I have uninstalled only Elmedia Player 4.3.7 previously installed. The Mac is:

    Model Name: Mac mini
    Model Identifier: Macmini6,2
    Processor Name: Intel Core i7
    Processor Speed: 2,6 GHz
    Number of Processors: 1
    Total Number of Cores: 4
    L2 Cache (per Core): 256 KB
    L3 Cache: 6 MB
    Memory: 16 GB
    Boot ROM Version: MM61.0106.B03
    SMC Version (system): 2.8f0

  5. HaX

    Update: so far, so good. I will post should some issue arise.

    I want also to say that it is a Mac mini with 1TB Apple Fusion Drive (128 GB SSD + 1TB rotational HD) inside as shown by Apple – About This Mac – System Report – Storage”:

    Physical Volumes:

    disk0s2:
    Media Name: APPLE SSD SM128E Media
    Size: 120,99 GB (120.988.852.224 bytes)
    Medium Type: SSD
    Protocol: SATA
    Internal: Yes
    Partition Map Type: GPT (GUID Partition Table)
    Status: Online
    S.M.A.R.T. Status: Verified

    disk1s2:
    Media Name: APPLE HDD HTS541010A9E662 Media
    Size: 999,34 GB (999.344.898.048 bytes)
    Medium Type: Rotational
    Protocol: SATA
    Internal: Yes
    Partition Map Type: GPT (GUID Partition Table)
    Status: Online
    S.M.A.R.T. Status: Verified

  6. HaX

    Update: kernel panic today while trying to copy text (selecting text and Command C) from a protected PDF document with Adobe Acrobat Pro XI v.11.0.10.

    But there is no “.panic” entry for it in the “Console – System Diagnostic Reports”.

  7. HaX

    New kernel panic today with Mac 10.10.3 (14D136). I have trashed
    com.AmbrosiaSW.AudioSupport 4.1.4
    and will report here should a new kernel panic arise.

  9. Michael Bender

    Awesome post. My kernal panics has been fixed! And now just fixing my trackpad and should be all good to go!

  10. blitz brigade blitz brigade get into blitz brigade gain a advantage blitz brigade hacks blitz brigade secrets and cheats blitz brigade power generator.

    Hey very cool website!! Man .. Excellent .. Superb .. I’ll bookmark your web site and take the
    feeds also? I am glad to seek out numerous helpful information right here in the put up, we want work out extra techniques in this regard, thanks for sharing.
    . . . . .

Comments are closed.