Diagnostic query: Unexpected kernel panic on macOS Sequoia 15.1 after waking (1794691713)

[Daniel Hayes]

Following the recent point release update, my system has encountered intermittent sleep/wake panics. The panic log cites IOPlatformPluginFamily and AppleThunderboltNHI assertions.

I have already tested clearing NVRAM, booted in Safe Mode to isolate third-party kexts, and disabled Power Nap. Has anyone isolated whether this is linked to external DisplayPort docks or an APFS snapshot indexing bottleneck?

[Marcus Reed]

The IOPlatformPluginFamily assertion often masks an underlying I/O stall caused by APFS snapshot consolidation racing with the wake path; run tmutil listlocalsnapshots / and purge any stale snapshots with tmutil deletelocalsnapshots before forcing a full volume verification via diskutil verifyVolume / in Recovery Mode. If First Aid reports “invalid sibling link” or “checkpoint mismatch” errors, the snapshot metadata tree is corrupted and requires an APFS container rebuild (diskutil apfs eraseContainer diskX followed by a clean restore) rather than a simple repair. Time Machine’s background backupd helper can hold IORegistry locks during wake if a local snapshot is mounted; disable automatic local snapshots via tmutil disablelocal as a mitigation while validating the NVMe controller’s thermal throttling logs with powermetrics --show-thermal-throttling.

Mac mini M4 Pro (48GB) | Studio Display

Chicago, IL | "Local Time Machine snapshots save every .0 upgrade week."

[Rachel Kim]

The AppleThunderboltNHI panic frequently correlates with a DisplayPort MST hub renegotiation storm triggered by WindowServer’s aggressive GPU context restore; capture a sysdiagnose immediately post-wake and grep for WindowServer CPU time exceeding 200% in top -l 1 -stats pid,command,cpu to confirm runaway compositing. Strip all third-party login items (defaults read com.apple.loginitems) and Safari extensions (defaults read com.apple.Safari ExtensionsEnabled), then test wake reliability with only Apple silicon native processes—WebKit’s GPUProcess often leaks IOSurface references across sleep when hardware-accelerated video decode is active. As a hardware isolation step, connect the external display directly via USB-C/DP alt-mode bypassing the dock; if the panic ceases, the dock’s firmware PD controller is violating the Thunderbolt NHI spec’s kIOPCIPowerState transition timing.

MacBook Pro 14″ M4 (32GB) | iPhone 15

Vancouver, BC | "Read crash logs bottom-up from the faulting thread."

[Alex Tanner]

While seemingly orthogonal, a corrupted com.apple.cloudd keychain sync token can deadlock the securityd daemon during wake, blocking the IOPlatformPluginFamily thermal policy evaluation; verify with log show --predicate 'subsystem == "com.apple.securityd"' --last 1h | grep -i "keychain|passkey|authd". Force a local keychain reset via security delete-generic-password -l "iCloud Keychain" -s "com.apple.account" followed by killall -HUP securityd to clear stale Passkey attestation caches that may hold IOService locks. If the panic log shows authd backtraces, disable “Allow this Mac to approve” in System Settings > Apple Account > Password & Security, then re-enable after a full shutdown to reset the Secure Enclave’s SEP firmware handshake state.

MacBook Air 15″ M3 (24GB) | AirPods Pro 2 USB-C

Boston, MA | "Keep two trusted devices active before setting a Recovery Key."

[Author]

Posts