Diagnostic query: Unexpected kernel panic on macOS Sequoia 15.1 after waking (1794703853)

[Claire Bennett]

Following the recent point release update, my system has encountered intermittent sleep/wake panics. The panic log cites IOPlatformPluginFamily and AppleThunderboltNHI assertions.

I have already tested clearing NVRAM, booted in Safe Mode to isolate third-party kexts, and disabled Power Nap. Has anyone isolated whether this is linked to external DisplayPort docks or an APFS snapshot indexing bottleneck?

[Daniel Hayes]

The AppleThunderboltNHI assertion alongside IOPlatformPluginFamily strongly indicates a Thunderbolt/USB4 path state machine failure during the D3cold-to-D0 transition, likely triggered by the dock’s DisplayPort MST hub failing to re-enumerate link training within the IOPCIDevice resume latency budget. Verify the dock’s PD controller firmware via system_profiler SPThunderboltDataType | grep -A 5 "Firmware Version" and cross-reference against the vendor’s Sequoia 15.1 compatibility matrix; a forced pmset -a tcpkeepalive 0 and hibernatemode 25 test isolates whether the panic persists in deep hibernation versus standard sleep. If the call stack shows IOThunderboltController::handleInterrupt timing out, disable “Wake for network access” and test with a direct-attach TB4 cable bypassing the dock’s upstream port to rule out retimer signal integrity degradation.

Mac Studio M2 Max (64GB / 2TB) | MacBook Pro 14″ M3 Pro

Seattle, WA | "Check pmset assertions before changing power defaults."

[Alex Tanner]

While unrelated to the IOPlatformPluginFamily panic signature, ensure your Apple Account security posture isn’t introducing background accountsdd or akd daemon contention during wake by auditing log show --predicate 'subsystem == "com.apple.accounts"' for kTCCErrorPolicyDenied spikes coinciding with the panic timestamps. Rotate the local device keychain sync identity via security delete-generic-password -l "iCloud Keychain" followed by a forced akd restart (launchctl kickstart -k gui/$(id -u)/com.apple.akd) to clear potential Secure Enclave nonce desynchronization that can manifest as watchdog timeouts if the T2/SEP handshake stalls during power state restoration. Confirm Passkey attestation certificates are valid (security find-certificate -c "Apple Passkey" -p) as expired roots rarely cause kernel panics but frequently stall userland resume completion.

MacBook Air 15″ M3 (24GB) | AirPods Pro 2 USB-C

Boston, MA | "Keep two trusted devices active before setting a Recovery Key."

[Liam O’Connor]

The bluetoothd and airplayd daemons aggressively renegotiate IOBluetoothHostController ACL links and AirPlayReceiver Bonjour advertisements on wake, which can starve the kernel_task workloop if the dock’s USB hub enumerates the Bluetooth controller on a shared PCIe lane with the TBT NHI. Update AirPods firmware by placing them in the case, opening the lid near the Mac, and verifying system_profiler SPBluetoothDataType | grep -A 10 "Firmware Version" shows the latest 6F7/6F8 build; simultaneously disable “Allow Handoff between this Mac and your iCloud devices” in General > AirDrop & Handoff to quiesce bluetoothaudiod resume traffic. For HomeKit, purge the local HomeKitAccessoryDeveloper keychain items (security delete-generic-password -s "com.apple.homekit") and toggle the Home Hub setting off/on in Home.app to force a fresh hap pairing database sync, eliminating mDNS storm contributions to the wake latency budget.

iMac 24″ M3 (16GB) | HomePod mini Stereo Pair

Dublin, IE | "Clean Wi-Fi multicast fixes half of AirPlay drops."

[Author]

Posts