Diagnostic query: Unexpected kernel panic on macOS Sequoia 15.1 after waking (1794688876)

[Rachel Kim]

Following the recent point release update, my system has encountered intermittent sleep/wake panics. The panic log cites IOPlatformPluginFamily and AppleThunderboltNHI assertions.

I have already tested clearing NVRAM, booted in Safe Mode to isolate third-party kexts, and disabled Power Nap. Has anyone isolated whether this is linked to external DisplayPort docks or an APFS snapshot indexing bottleneck?

[Emily Hart]

A corrupted Auto Unlock handshake between the Mac and Apple Watch can stall the IOPlatformPluginFamily power state transition during wake, manifesting as a Thunderbolt NHI assertion timeout. Verify the secure element synchronization status via log show --predicate 'subsystem == "com.apple.bluetooth"' --last 1h | grep -i "autounlock|handoff" and remove/re-pair the Watch in System Settings > Touch ID & Password > Apple Watch to clear stale encryption keys. Concurrently, ensure the Mac’s battery health (System Information > Power) isn’t reporting “Service Recommended,” as gas gauge inaccuracies trigger aggressive AppleThrottle interventions that conflict with TBT retimer firmware. If Stage Manager was active on an external iPad via Sidecar, disconnect it before sleep; the WindowServer context preservation across the USB-C/Thunderbolt link frequently deadlocks the NHI controller during dark wake.

iPad Pro 13″ M4 | Apple Watch Ultra 2 | iPhone 15 Pro

Toronto, ON | "Battery cycle count beats random percentage guesses."

[Sarah Mitchell]

An incomplete or delta-updated iOS/iPadOS installer staged on the Mac’s APFS volume (often hidden in /Library/Updates or ~/Library/Application Support/Apple/SoftwareUpdate) can trigger mds/mdworker snapshot indexing storms that saturate the IOKit power management semaphores. Boot into macOS Recovery (⌘R), open Terminal, and run diskutil apfs listSnapshots / to purge any stale com.apple.os.update- snapshots consuming metadata space. For USB-C/Thunderbolt dock isolation, use system_profiler SPUSBDataType SPThunderboltDataType in Recovery to verify the dock’s PD controller firmware version against the vendor’s latest; a mismatched PD contract (e.g., 60W vs 96W negotiation) causes the AppleThunderboltNHI to assert kIONotPrivileged during the IOPCIDevice::setPowerState callback. If the panic persists with all* peripherals disconnected, perform a full DFU-mode restore of the BridgeOS (on T2/Apple Silicon) via Apple Configurator 2 to rule out SEP/THC firmware corruption.

iPhone 16 Pro (256GB, iOS 26) | iPad Air M2

Austin, TX | "Always try Finder Update before touching Restore."

[Nina Patel]

The Sequoia 15.1 supplemental security patch (HT2149xx) modified Sandbox.kext policies for com.apple.WebKit.Networking, inadvertently introducing a race condition where powerd’s IOPMrootDomain assertions are dropped if a Safari NetworkProcess holds a PreventUserIdleSystemSleep assertion during the wake transition. Check pmset -g assertions | grep -i "preventuseridlesystemsleep" immediately post-wake to identify the offending PID; if it maps to Safari or com.apple.WebKit, disable Settings > Safari > Advanced > Feature Flags > “Background Fetch” and Intelligent Tracking Prevention logging verbosity via defaults write com.apple.Safari IncludeDevelopMenu -bool true then Develop > Experimental Features > [disable ITP Logging]. Separately, a known familycircled daemon leak (FB134xxxxx) correlates with iCloud Keychain sync failures during wake; run log stream --predicate 'process == "familycircled"' --level error and sign out/in of System Settings > Apple ID > iCloud > Keychain to reset the CloudKit container token.

MacBook Pro 14″ M1 Pro (32GB) | iPhone 15 Plus

Melbourne, AU | "Verify Rapid Security Response builds right in Settings > About."

[Author]

Posts