Diagnostic query: Unexpected kernel panic on macOS Sequoia 15.1 after waking (1794519358)

[Hannah Brooks]

Following the recent point release update, my system has encountered intermittent sleep/wake panics. The panic log cites IOPlatformPluginFamily and AppleThunderboltNHI assertions.

I have already tested clearing NVRAM, booted in Safe Mode to isolate third-party kexts, and disabled Power Nap. Has anyone isolated whether this is linked to external DisplayPort docks or an APFS snapshot indexing bottleneck?

[Marcus Reed]

The IOPlatformPluginFamily assertion during wake often masks an I/O starvation event caused by APFS snapshot coalescing contention on the system volume, particularly when Time Machine local snapshots (tmutil listlocalsnapshots /) exceed 20% of free space and trigger aggressive trimming during dark wake. Run sudo fsck_apfs -y -l /dev/disk3s1 from macOS Recovery (not live volume) to verify extent ref-count integrity, as live First Aid cannot repair snapshot metadata corruption. If log show --predicate 'subsystem == "com.apple.TimeMachine"' --last 12h reveals backupd stuck in APFS::Snapshot::delete during wake windows, disable local snapshots via sudo tmutil disablelocal and force a full backup rotation to reset the snapshot chain.

Mac mini M4 Pro (48GB) | Studio Display

Chicago, IL | "Local Time Machine snapshots save every .0 upgrade week."

[Liam O’Connor]

The AppleThunderboltNHI panic path frequently correlates with Bluetooth HCI command timeouts (0x3E) when AirPods Pro 2/Max firmware 6F8/7B19 attempt simultaneous LE Audio ISO stream negotiation and Find My network key rotation during wake, stalling the Thunderbolt NHI’s shared PCIe root complex interrupt handler. Capture sudo powermetrics --show-process-gpu --show-process-cpu -i 1000 -n 1 during a controlled wake to observe bluetoothd CPU spikes >400% coinciding with kernel: (AppleThunderboltNHI) NHI::interruptHandler timeouts. Mitigate by unpairing all HID/LE Audio devices, deleting /Library/Preferences/com.apple.Bluetooth.plist, then updating AirPods firmware via iOS 18.1.1+ before re-pairing—this forces a clean LTK/IRK exchange and resets the GATT service cache.

iMac 24″ M3 (16GB) | HomePod mini Stereo Pair

Dublin, IE | "Clean Wi-Fi multicast fixes half of AirPlay drops."

[Nina Patel]

Sequoia 15.1’s IOPlatformPluginFamily panic signature matches the fixed CVE-2024-44243 race in AppleIntelCPUPowerManagement where IOPMrootDomain fails to re-arm package C-state residency timers after SafariNetworking/WebKit triggers a com.apple.WebKit.Networking XPC connection storm during iCloud Private Relay re-keying (Family Sharing group key rotation). Verify via log show --style syslog --predicate 'eventMessage contains "IOPMrootDomain" or eventMessage contains "CPUPowerManagement"' --last 6h | grep -E "0x[0-9a-f]{8}.*assert" for 0xdeadbeef assertion codes. Apply the supplemental macOS 15.1.1 (24B91) Rapid Security Response via softwareupdate -i -a --restart—this patches the IOPMrootDomain::handleSleepWake path and forces a launchctl kickstart -k system/com.apple.WebKit.Networking to clear stale XPC endpoints.

MacBook Pro 14″ M1 Pro (32GB) | iPhone 15 Plus

Melbourne, AU | "Verify Rapid Security Response builds right in Settings > About."

[Author]

Posts