Kernel Panic on macOS Tahoe 26.3.1

[EspoTek]

Also affects LabraScope. It seems to be related to libusb, there was talk of some Tahoe-related fix in libusb 1.0.29. Does not crash unless both the board is connected and an app is trying to access it via libusb.

I'll look into this over the next few days.

[EspoTek]

It is not related to libusb from the look of things, updating to 1.0.29 fixes nothing.

Affected hardware is Macbook Pro M1 14". No issues at all on 26.3.0.

[EspoTek]

panic(cpu 0 caller 0xfffffe002ffdd20c): Kernel data abort. at pc 0xfffffe0032766000, lr 0xfffffe0032761430 (saved state: 0xfffffe822df2f4f0)
x0: 0x0000000000000001 x1: 0xfffffe32ba813372 x2: 0x0000000000000000 x3: 0x0000000000000000
x4: 0x0000000000000003 x5: 0xfffffe391ba13810 x6: 0xfffffe822df2f950 x7: 0xfffffe002f568218
x8: 0x0000000000000001 x9: 0x0000000000000001 x10: 0xfffffe32ba813379 x11: 0x0000000000000003
x12: 0x4dd87e0032761068 x13: 0x0000000000000001 x14: 0x0000000000000001 x15: 0x0000000000000001
x16: 0xfffffe002f56f248 x17: 0xab6bfe002f56f248 x18: 0x0000000000000000 x19: 0xfffffe391ba13810
x20: 0xfffffe32ba813372 x21: 0xfffffe2cecddc200 x22: 0x0000000000000001 x23: 0x0000000000000000
x24: 0xfffffe32ba813369 x25: 0x0000000000000000 x26: 0xfffffe391ba13814 x27: 0x0000000000000000
x28: 0xfffffe0033435000 fp: 0xfffffe822df2f880 lr: 0xfffffe0032761430 sp: 0xfffffe822df2f840
pc: 0xfffffe0032766000 cpsr: 0x60401208 esr: 0x0000000096000006 far: 0x0000000000000003

Debugger message: panic
Memory ID: 0x1
OS release type: User
OS version: 25D2128
Kernel version: Darwin Kernel Version 25.3.0: Wed Jan 28 20:54:46 PST 2026; root:xnu-12377.91.3~2/RELEASE_ARM64_T6000
Fileset Kernelcache UUID: 9EA58A60806E690EA1FDEC7D95B60B67
Kernel UUID: 4304175B-D5D6-3B4D-B774-51C6CB3467DD
Boot session UUID: BED0D146-B34A-4244-B69D-06866968C354
iBoot version: iBoot-13822.81.10
iBoot Stage 2 version: iBoot-13822.81.10
secure boot?: YES
roots installed: 0
Paniclog version: 15
KernelCache slide: 0x0000000026e00000
KernelCache base: 0xfffffe002de04000
Kernel slide: 0x0000000026e08000
Kernel text base: 0xfffffe002de0c000
Kernel text exec slide: 0x0000000028668000
Kernel text exec base: 0xfffffe002f66c000
mach_absolute_time: 0x223efc4ee
Epoch Time: sec usec
Boot : 0x69a98d4c 0x0009fe96
Sleep : 0x00000000 0x00000000
Wake : 0x00000000 0x00000000
Calendar: 0x69a98ec4 0x000ddc87

Zone info:
Zone map: 0xfffffe1320000000 - 0xfffffe3920000000
. VM : 0xfffffe1320000000 - 0xfffffe18ec000000
. RO : 0xfffffe18ec000000 - 0xfffffe1b86000000
. GEN0 : 0xfffffe1b86000000 - 0xfffffe2152000000
. GEN1 : 0xfffffe2152000000 - 0xfffffe271e000000
. GEN2 : 0xfffffe271e000000 - 0xfffffe2cea000000
. GEN3 : 0xfffffe2cea000000 - 0xfffffe32b6000000
. DATA : 0xfffffe32b6000000 - 0xfffffe3920000000
Metadata: 0xfffffe811e010000 - 0xfffffe8127810000
Bitmaps : 0xfffffe8127810000 - 0xfffffe812a524000
Extra : 0 - 0

TPIDRx_ELy = {1: 0xfffffe21557eafe0 0: 0x0000000000000000 0ro: 0x00000001fa3971e0 }
CORE 0 PVH locks held: None
CORE 1 PVH locks held: None
CORE 2 PVH locks held: None
CORE 3 PVH locks held: None
CORE 4 PVH locks held: None
CORE 5 PVH locks held: None
CORE 6 PVH locks held: None
CORE 7 PVH locks held: None
CORE 8 PVH locks held: None
CORE 9 PVH locks held: None
CORE 0 is the one that panicked. Check the full backtrace for details.
CORE 1: PC=0xfffffe00312e94f0, LR=0xfffffe00312e9364, FP=0xfffffe822ceb3db0
CORE 2: PC=0xfffffe002f708acc, LR=0xfffffe002f708acc, FP=0xfffffe822df23ed0
CORE 3: PC=0xfffffe002f708acc, LR=0xfffffe002f708acc, FP=0xfffffe822dbc3ed0
CORE 4: PC=0xfffffe002f708acc, LR=0xfffffe002f708acc, FP=0xfffffe822dbb7ed0
CORE 5: PC=0xfffffe002f708acc, LR=0xfffffe002f708acc, FP=0xfffffe822e177ed0
CORE 6: PC=0xfffffe002f708acc, LR=0xfffffe002f708acc, FP=0xfffffe822e357ed0
CORE 7: PC=0xfffffe002f708acc, LR=0xfffffe002f708acc, FP=0xfffffe822de4bed0
CORE 8: PC=0xfffffe002f708acc, LR=0xfffffe002f708acc, FP=0xfffffe822c937ed0
CORE 9: PC=0xfffffe002f708acc, LR=0xfffffe002f708acc, FP=0xfffffe822deb7ed0
Compressor Info: 1% of compressed pages limit (OK) and 2% of segments limit (OK) with 0 swapfiles and OK swap space
Panicked task 0xfffffe204d8cdd58: 17528 pages, 9 threads: pid 3991: Labrador
Panicked thread: 0xfffffe21557eafe0, backtrace: 0xfffffe822df2ea90, tid: 24357
lr: 0xfffffe002f6c9cf0 fp: 0xfffffe822df2eb20
lr: 0xfffffe002f83a6a4 fp: 0xfffffe822df2eb90
lr: 0xfffffe002f83889c fp: 0xfffffe822df2ec50
lr: 0xfffffe002f66fb88 fp: 0xfffffe822df2ec60
lr: 0xfffffe002f6c9fbc fp: 0xfffffe822df2f140
lr: 0xfffffe002ffd1918 fp: 0xfffffe822df2f160
lr: 0xfffffe002ffdd20c fp: 0xfffffe822df2f370
lr: 0xfffffe002f83a500 fp: 0xfffffe822df2f410
lr: 0xfffffe002f838a10 fp: 0xfffffe822df2f4d0
lr: 0xfffffe002f66fb88 fp: 0xfffffe822df2f4e0
lr: 0xfffffe0032766000 fp: 0xfffffe822df2f880
lr: 0xfffffe002ff1b4ac fp: 0xfffffe822df2f8b0
lr: 0xfffffe002ff1b7bc fp: 0xfffffe822df2fa40
lr: 0xfffffe002f80046c fp: 0xfffffe822df2fb60
lr: 0xfffffe002f6d1050 fp: 0xfffffe822df2fc00
lr: 0xfffffe002f6a3fe0 fp: 0xfffffe822df2fc60
lr: 0xfffffe002f6ba690 fp: 0xfffffe822df2fcb0
lr: 0xfffffe002f6bac68 fp: 0xfffffe822df2fda0
lr: 0xfffffe002f82d19c fp: 0xfffffe822df2fe50
lr: 0xfffffe002f838d70 fp: 0xfffffe822df2ff10
lr: 0xfffffe002f66fb88 fp: 0xfffffe822df2ff20
lr: 0x000000018e090c34 fp: 0x0000000000000000
Kernel Extensions in backtrace:
com.apple.iokit.IOUSBHostFamily(1.2)[D98223E1-9F64-3FEA-A918-67D9D9AB6404]@0xfffffe003275ad50->0xfffffe00327ffbaf
dependency: com.apple.driver.AppleARMPlatform(1.0.2)[61C5815C-29CD-3680-96B7-22406C9881C3]@0xfffffe00301a3460->0xfffffe00301fb98f
dependency: com.apple.driver.AppleMobileFileIntegrity(1.0.5)[5A056354-F139-3415-85EA-ECDE7A7E91A2]@0xfffffe0030ef2a70->0xfffffe0030f27f9f
dependency: com.apple.driver.AppleSMC(3.1.9)[CD59F516-8857-3830-A581-2213F0F2DA98]@0xfffffe003116bab0->0xfffffe00311942e3
dependency: com.apple.driver.usb.AppleUSBCommon(1.0)[A6AEC649-61A5-30CE-920F-6513634894C0]@0xfffffe003168e520->0xfffffe0031693eb7
dependency: com.apple.driver.AppleUSBHostMergeProperties(1.2)[5775D1F2-9369-3AD9-A73E-C3F57A2475CA]@0xfffffe0032909ea0->0xfffffe003290a9cf
dependency: com.apple.iokit.IOAccessoryManager(1.0.0)[DE0E12C1-2501-3673-BA22-77E799718B97]@0xfffffe0031dd1500->0xfffffe0031ecb3cb
dependency: com.apple.iokit.IOPortFamily(1.0)[8505049F-48BA-346F-AD55-3A42E08837C3]@0xfffffe00322eb140->0xfffffe00322eb1c3

last started kext at 9114323381: com.apple.driver.usb.cdc 5.0.0 (addr 0xfffffe002e5688a0, size 2088)
loaded kexts:
com.apple.filesystems.autofs 3.0
com.apple.driver.AppleTopCaseHIDEventDriver 9430.1
com.apple.driver.CoreKDL 1
com.apple.driver.AppleBiometricServices 1
com.apple.driver.DiskImages.ReadWriteDiskImage 493.0.0
com.apple.driver.DiskImages.UDIFDiskImage 493.0.0
com.apple.driver.DiskImages.RAMBackingStore 493.0.0
com.apple.driver.DiskImages.FileBackingStore 493.0.0
com.apple.driver.SEPHibernation 1
com.apple.driver.AppleFileSystemDriver 3.0.1
com.apple.nke.l2tp 1.9
com.apple.filesystems.tmpfs 1
com.apple.filesystems.nfs 1
com.apple.filesystems.lifs 1
com.apple.filesystems.apfs 2632.80.1
com.apple.IOTextEncryptionFamily 1.0.0
com.apple.filesystems.hfs.kext 704.60.4
com.apple.security.BootPolicy 1
com.apple.BootCache 40
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1
com.apple.driver.AppleSmartBatteryManager 161.0.0
com.apple.driver.AppleUSBDeviceNCM 5.0.0
com.apple.driver.AppleThunderboltIP 4.0.3
com.apple.driver.ApplePMP 1
com.apple.driver.AppleSN012776Amp 930.11
com.apple.driver.AppleAOPVoiceTrigger 500.14
com.apple.AppleEmbeddedSimpleSPINORFlasher 1
com.apple.driver.AppleSmartIO2 1
com.apple.driver.AppleCS42L84Audio 930.11
com.apple.driver.AppleT6000SOCTuner 1
com.apple.driver.AppleT6000CLPCv3 1
com.apple.driver.ApplePMPFirmware 1
com.apple.driver.AppleDPDisplayTCON 1
com.apple.driver.AppleInterruptControllerV2 1.0.0d1
com.apple.driver.AppleAVE2 905.29.1
com.apple.driver.AppleT6000PMGR 1
com.apple.driver.AppleS8000DWI 1.0.0d1
com.apple.iokit.IOUserEthernet 1.0.1
com.apple.driver.usb.AppleUSBUserHCI 1
com.apple.iokit.IOKitRegistryCompatibility 1
com.apple.iokit.EndpointSecurity 1
com.apple.driver.AppleDiskImages2 514.80.3
com.apple.driver.AppleS5L8960XNCO 1
com.apple.driver.AppleSamsungSerial 1.0.0d1
com.apple.driver.AppleEventLogHandler 1
com.apple.driver.AppleSerialShim 1
com.apple.driver.AppleMCDP29XXUpdateSupport 1
com.apple.AGXG13X 345.20.4
com.apple.driver.AppleAVD 908
com.apple.driver.AppleJPEGDriver 7.7.2
com.apple.driver.AppleProResHW 526.5
com.apple.driver.AppleT8110DART 1
com.apple.driver.AppleMobileDispT600X-DCP 140.0
com.apple.driver.usb.AppleSynopsysUSB40XHCI 1
com.apple.driver.AppleS8000AES 1
com.apple.driver.AppleBCMWLANBusInterfacePCIe 1
com.apple.driver.AppleS5L8920XPWM 1.0.0d1
com.apple.driver.AudioDMAController-T600x 530.10
com.apple.driver.AppleT6000DART 1
com.apple.driver.AppleS5L8940XI2C 1.0.0d2
com.apple.driver.AppleM68Buttons 1.0.0d1
com.apple.driver.AppleBluetoothModule 1
com.apple.driver.AppleSPIMC 1
com.apple.driver.AppleT6000 1
com.apple.driver.AppleSDXC 3.5.4
com.apple.AppleSystemPolicy 2.0.0
com.apple.kec.InvalidateHmac 1
com.apple.kec.AppleEncryptedArchive 1
com.apple.driver.usb.cdc 5.0.0
com.apple.driver.AppleUSBAudio 830.32
com.apple.iokit.IOAudioFamily 700.2
com.apple.driver.driverkit.serial 6.0.0
com.apple.driver.AppleActuatorDriver 9430.5
com.apple.driver.AppleHIDKeyboard 9410.2
com.apple.driver.AppleMultitouchDriver 9430.5
com.apple.driver.AppleMesaSEPDriver 100.99
com.apple.iokit.IOBiometricFamily 1
com.apple.iokit.IOAVBFamily 1400.10
com.apple.driver.DiskImages.KernelBacked 493.0.0
com.apple.driver.AppleSEPHDCPManager 1.0.1
com.apple.driver.AppleTrustedAccessory 1
com.apple.iokit.AppleSEPGenericTransfer 1
com.apple.driver.AppleXsanScheme 3
com.apple.nke.ppp 1.9
com.apple.driver.AppleBSDKextStarter 3
com.apple.kext.triggers 1.0
com.apple.driver.usb.AppleUSBHostPacketFilter 1.0
com.apple.filesystems.hfs.encodings.kext 1
com.apple.driver.AppleSyntheticGameController 13.3.1
com.apple.driver.AppleBTM 1.0.1
com.apple.driver.IOHIDPowerSource 1
com.apple.driver.AppleCallbackPowerSource 1
com.apple.driver.AppleConvergedIPCOLYBTControl 1
com.apple.driver.AppleConvergedPCI 1
com.apple.driver.AppleBluetoothDebug 1
com.apple.driver.usb.networking 5.0.0
com.apple.driver.AppleThunderboltPCIDownAdapter 4.1.1
com.apple.driver.AppleThunderboltDPInAdapter 8.5.1
com.apple.driver.AppleThunderboltDPAdapterFamily 8.5.1
com.apple.driver.AppleThunderboltUSBDownAdapter 1.0.4
com.apple.driver.AppleAuthCP 1.0.0
com.apple.driver.AppleDCPDPTXProxy 1.0.0
com.apple.driver.DCPDPFamilyProxy 1
com.apple.driver.AppleSSE 1.0
com.apple.driver.AppleHIDTransportSPI 9420.1
com.apple.driver.AppleHIDTransport 9420.1
com.apple.driver.AppleInputDeviceSupport 9420.1
com.apple.driver.AppleAOPAudio 500.14
com.apple.driver.AppleALSColorSensor 1.0.0d1
com.apple.EXBrightCalibrationConsumer 1.0.0
com.apple.driver.AppleHPM 3.4.4
com.apple.plugin.IOgPTPPlugin 1420.2
com.apple.driver.AppleDiagnosticDataAccessReadOnly 1.0.0
com.apple.driver.ApplePassthroughPPM 3.0
com.apple.driver.AppleCSEmbeddedAudio 930.11
com.apple.driver.AppleEmbeddedAudio 930.11
com.apple.iokit.AppleARMIISAudio 520.2
com.apple.driver.IISAudioIsolatedStreamECProxy 520.2
com.apple.driver.ExclavesAudioKext 300.59
com.apple.driver.AppleSPU 1
com.apple.AGXFirmwareKextG13XRTBuddy 345.20.4
com.apple.AGXFirmwareKextRTBuddy64 345.20.4
com.apple.iokit.IONVMeFamily 2.1.0
com.apple.driver.AppleNANDConfigAccess 1.0.0
com.apple.driver.AppleSPMIPMU 1.0.1
com.apple.driver.AppleDialogPMU 1.0.1
com.apple.driver.AppleStockholmControl 1.0.0
com.apple.driver.AppleMobileApNonce 1
com.apple.driver.ApplePMGR 1
com.apple.driver.DiskImages 493.0.0
com.apple.iokit.IOBluetoothFamily 9.0.0
com.apple.driver.AppleUIO 1
com.apple.driver.AppleSEPKeyStore 2
com.apple.driver.AppleUSBTDM 557
com.apple.iokit.IOUSBMassStorageDriver 272.80.3
com.apple.iokit.IOSCSIBlockCommandsDevice 541.40.1
com.apple.iokit.IOSCSIArchitectureModelFamily 541.40.1
com.apple.driver.AppleRSMChannel 1
com.apple.iokit.IORSMFamily 1
com.apple.driver.AppleLockdownMode 1
com.apple.driver.AppleIPAppender 1.0
com.apple.driver.AppleFDEKeyStore 28.30
com.apple.driver.AppleEffaceableStorage 1.0
com.apple.driver.AppleCredentialManager 1.0
com.apple.driver.AppleBiometricSensor 2
com.apple.driver.AppleSART 1
com.apple.driver.AppleThunderboltNHI 7.2.81
com.apple.iokit.IOGPUFamily 129.3.2
com.apple.iokit.IOGraphicsFamily 599
com.apple.driver.AppleH11ANEInterface 9.300.0
com.apple.driver.FairPlayIOKit 72.14.0
com.apple.iokit.IOMobileGraphicsFamily-DCP 343.0.0
com.apple.iokit.IOMobileGraphicsFamily 343.0.0
com.apple.driver.AppleSEPManager 1.0.1
com.apple.driver.AppleM2ScalerCSCDriver 265.0.0
com.apple.AUC 1.0
com.apple.driver.DCPAVFamilyProxy 1
com.apple.driver.AppleDCP 1
com.apple.driver.AppleFirmwareKit 1
com.apple.driver.AppleSPMI 1.0.1
com.apple.driver.AppleUSBXDCIARM 1.0
com.apple.driver.AppleUSBXDCI 1.0
com.apple.iokit.IOUSBDeviceFamily 2.0.0
com.apple.driver.usb.AppleSynopsysUSBXHCI 1
com.apple.driver.usb.AppleUSBXHCI 1.2
com.apple.driver.AppleEmbeddedUSBHost 1
com.apple.driver.usb.AppleUSBHub 1.2
com.apple.driver.usb.AppleUSBHostCompositeDevice 1.2
com.apple.driver.AppleT6000TypeCPhy 1
com.apple.driver.AppleT8103TypeCPhy 1
com.apple.driver.AppleA7IOP-ASCWrap-v4 1.0.2
com.apple.driver.AppleARMWatchdogTimer 1
com.apple.driver.AppleBluetoothDebugService 1
com.apple.driver.AppleBCMWLANCore 1.0.0
com.apple.iokit.IOTimeSyncFamily 1420.2
com.apple.iokit.IO80211Family 1200.13.1
com.apple.driver.IOImageLoader 1.0.0
com.apple.driver.AppleOLYHAL 1
com.apple.driver.AppleT6000PCIeC 1
com.apple.driver.AppleT600xPCIe 1
com.apple.driver.AppleMCA2-T600x 1000.4
com.apple.driver.AppleEmbeddedAudioLibs 500.4
com.apple.driver.AppleFirmwareUpdateKext 1
com.apple.driver.AppleGPIOICController 1.0.2
com.apple.driver.AppleDisplayCrossbar 1.0.0
com.apple.iokit.IOThunderboltFamily 9.3.3
com.apple.iokit.IODisplayPortFamily 1.0.0
com.apple.iokit.IOAVFamily 1.0.0
com.apple.iokit.IOHDCPFamily 1.0.0
com.apple.iokit.IOCECFamily 1
com.apple.iokit.IOAudio2Family 1.0
com.apple.driver.AppleIISController 500.2
com.apple.driver.AppleAudioClockLibs 500.4
com.apple.driver.AppleTypeCPhy 1
com.apple.driver.AppleA7IOP-M3Wrap-v2 1.0.2
com.apple.driver.AppleT8103PCIeCPIODMA 1
com.apple.driver.AppleMultiFunctionManager 1
com.apple.driver.corecapture 1.0.4
com.apple.driver.AppleH13CameraInterface 10.300.0
com.apple.iokit.IOSurface 393.3.2
com.apple.iokit.IOUSBHostFamily 1.2
com.apple.driver.AppleUSBHostMergeProperties 1.2
com.apple.driver.usb.AppleUSBCommon 1.0
com.apple.driver.AppleSMC 3.1.9
com.apple.driver.RTBuddy 1.0.0
com.apple.driver.AppleEmbeddedTempSensor 1.0.0
com.apple.driver.AppleARMPMU 1.0
com.apple.driver.AppleA7IOP 1.0.2
com.apple.driver.IOSlaveProcessor 1
com.apple.driver.AppleFireStormErrorHandler 1
com.apple.driver.AppleEmbeddedPCIE 1
com.apple.iokit.IOPortFamily 1.0
com.apple.iokit.IOPCIFamily 2.9
com.apple.iokit.IOAccessoryManager 1.0.0
com.apple.iokit.IOHIDFamily 2.0.0
com.apple.driver.AppleOnboardSerial 1.0
com.apple.iokit.IOSkywalkFamily 1.0
com.apple.driver.mDNSOffloadUserClient 1.0.1b8
com.apple.iokit.IONetworkingFamily 3.4
com.apple.iokit.IOSerialFamily 11
com.apple.driver.IODARTFamily 1
com.apple.driver.ApplePIODMA 1
com.apple.driver.AppleARMPlatform 1.0.2
com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0
com.apple.iokit.IOReportFamily 47
com.apple.security.quarantine 4
com.apple.security.sandbox 300.0
com.apple.iokit.IOStorageFamily 2.1
com.apple.kext.AppleMatch 1.0.0d1
com.apple.driver.AppleMobileFileIntegrity 1.0.5
com.apple.iokit.CoreAnalyticsFamily 1
com.apple.security.AppleImage4 7.0.0
com.apple.kext.CoreTrust 1
com.apple.iokit.IOCryptoAcceleratorFamily 1.0.1
com.apple.kec.pthread 1
com.apple.kec.Libm 1
com.apple.kec.Compression 1.0
com.apple.kec.corecrypto 26.0

** Stackshot Succeeded ** Bytes Traced 604877 (Uncompressed 1446512) **

[EspoTek]

It seems like the device cannot be found by lsusb either after updating.

[EspoTek]

Looks to be the same bug that Joe Darling came across. Upgrading to 26.4 Beta 3 does not fix. Bugger.

[EspoTek]

New branch firmware-spec-compliant doesn't panic on libusb_claim_interface any more. However librador itself still panics.

(trebay-private) ➜  tahoe_iso_panic_test ./tahoe_iso_panic_repro
=== IOUSBHostFamily kernel panic reproducer ===
Target: macOS Tahoe 26.x, IOUSBHostFamily 1.2
Device: 03eb:ba94 interface 0

WARNING: This will likely cause a kernel panic.

[+] libusb initialized
[+] Device opened
[*] Calling libusb_claim_interface(0)...
    (kernel panic expected here)
[+] Interface claimed (panic did NOT reproduce)

[EspoTek]

Nope, it just got deferred to libusb_set_interface_alt_setting