Uninstalled kext will not unload from Kernel

Question

In mojave I had previously loaded a DisplayLink Driver kext from displaylink.com. After updating to catalina, I uninstalled via it's uninstaller which removed the kext files and rebuilt the cache. I rebooted and the kext is still loaded per kextstat. Rebuilt manually using kextcache, still there after reboot. Tried removing manually with kextunload and system crashes. Reinstalled and uninstalled no change. Stumped here.

The kext was originally in /Library/Extensions, it is completely gone yet the Kernel still shows the extension as running.

42 0 0xffffff7f828e7000 0xc000 0xc000 com.displaylink.driver.DisplayLinkDriver (5.0 (42)) 4E4C9A34-2960-3AC0-8BB7-861686561DAB <41 13 6 5 3>

Any ideas?

Kernel

3.1k

Posted by

Omniver

Reply

Add a Comment

Answer 1

Following these instructions should fix this: https://obdev.at/support/index.html?product=LS&topic=faq&entry=245694426255130

That’s an FAQ entry from the Little Snitch support page. I’m one of the developers of Little Snitch and we have a problem that probably has the same root cause: The kernel cache update is triggered correctly, but the cache isn’t really updated. This means that uninstalled kexts remain in the kernel cache (as in your case) or that updating existing kexts doesn’t work (as in the case of Little Snitch).

Just about everyone who updates to macOS Catalina is hit by this problem and we have a massive support burden thanks to this problem. I hope Apple fixes this soon!

Posted by

marco.masser

Add a Comment

Answer 2

same problem, and the solution worked for me

Posted by

Adeze

Add a Comment

Answer 3

FYI: This is fixed in macOS 10.15.1

Posted by

marco.masser

Add a Comment

Answer 4

the following (source: apple.stackexchange.com/a/352584) worked for me on Mojave (after csrutil disable) after switching from LittleSnitch firewall to LuLu firewall

Code Block $ sudo sqlite3 /private/var/db/SystemPolicyConfiguration/KextPolicy
SQLite version 3.24.0 2018-06-04 14:10:15
Enter ".help" for usage hints.
sqlite> SELECT * FROM kext_policy;
MLZF7K7B5R|at.obdev.nke.LittleSnitch|1|Objective Development Software GmbH|1
6HB5Y2QTA3|com.hp.kext.io.enabler.compound|1|HP Inc.|0
VBG97UB4TA|com.objective-see.lulu|1|Objective-See, LLC|1
25783EJD83|com.kernsafe.driver.kscsiprt|1|KernSafe Technology|1
sqlite> DELETE FROM kext_policy WHERE team_id = 'MLZF7K7B5R';

Also for getting rid of Kernsafe iscsi driver (why does not Apple provide a native iscsi initiator?!) I had to rebuild the kernel cache and remove all leftover files in /Library/Extensions/KScsiPrt.kext and /Library/StagedExtensions/Library/Extensions/KScsiPrt.kext

Posted by

it.cgusa

Add a Comment

Uninstalled kext will not unload from Kernel

Replies