How to symbolicate a kernel panic report on OSX

Hi, I want to know how can I symbolicate a kernel panic report (not a regular app crash report). I have an OSX app that a user claims caused a kernel panic. It doesn't install any kernel extension but a launch daemon. I have followed this link https://developer.apple.com/library/mac/technotes/tn2063/_index.html but it only describes symbolication steps for the 3rd party kernel extension causing a kernel panic. How can I symbolicate the following panic report if I have not installed any kext? Any help will be appreciable.

Anonymous UUID: DF6F780A-AA27-6D40-3441-F26F828C7096

Tue Oct 27 12:02:41 2015

*** Panic Report ***

panic(cpu 1 caller 0xffffff80111d6a9a): Kernel trap at 0xffffff80113cec30, type 14=page fault, registers:

CR0: 0x000000008001003b, CR2: 0x0000000100000057, CR3: 0x000000025eade116, CR4: 0x00000000001627e0

RAX: 0xffffff8037f9bdb0, RBX: 0xffffff803e68cd08, RCX: 0xffffff8037f9bdb0, RDX: 0xffffff8011910910

RSP: 0xffffff9236923890, RBP: 0xffffff9236923900, RSI: 0x0000000000000001, RDI: 0xffffff8011910910

R8: 0x0000000000000000, R9: 0x00000000000001f0, R10: 0xffffff80118ddb78, R11: 0x0000000000000000

R12: 0x00000000ffffffff, R13: 0x0000000000000000, R14: 0xffffff80117a1f7b, R15: 0xffffff8031c77a40

RFL: 0x0000000000010206, RIP: 0xffffff80113cec30, CS: 0x0000000000000008, SS: 0x0000000000000000

Fault CR2: 0x0000000100000057, Error code: 0x0000000000000000, Fault CPU: 0x1, PL: 0

Backtrace (CPU 1), Frame : Return Address

0xffffff9236923520 : 0xffffff80110e5357

0xffffff92369235a0 : 0xffffff80111d6a9a

0xffffff9236923780 : 0xffffff80111f4093

0xffffff92369237a0 : 0xffffff80113cec30

0xffffff9236923900 : 0xffffff80113d0229

0xffffff9236923920 : 0xffffff801140edc7

0xffffff9236923a40 : 0xffffff801140c838

0xffffff9236923ad0 : 0xffffff801135bdac

0xffffff9236923ba0 : 0xffffff801135bfff

0xffffff9236923bd0 : 0xffffff801139912d

0xffffff9236923d80 : 0xffffff80113983fd

0xffffff9236923da0 : 0xffffff8011596f61

0xffffff9236923de0 : 0xffffff80115f0ebc

0xffffff9236923e30 : 0xffffff80115f13ea

0xffffff9236923e50 : 0xffffff801158a610

0xffffff9236923ec0 : 0xffffff8011586140

0xffffff9236923f20 : 0xffffff801158a2b4

0xffffff9236923f60 : 0xffffff801162ace1

0xffffff9236923fb0 : 0xffffff80111f4896

BSD process name corresponding to current thread: MyApp

Mac OS version:

15A284

Kernel version:

Darwin Kernel Version 15.0.0: Wed Aug 26 16:57:32 PDT 2015; root:xnu-3247.1.106~1/RELEASE_X86_64

Kernel UUID: 37BC582F-8BF4-3F65-AFBB-ECF792060C68

Kernel slide: 0x0000000010e00000

Kernel text base: 0xffffff8011000000

__HIB text base: 0xffffff8010f00000

System model name: MacBookPro11,3 (Mac-2BD1B31983FE1663)

System uptime in nanoseconds: 48947258824078

last loaded kext at 46570627969383: com.apple.driver.AppleMikeyHIDDriver 124 (addr 0xffffff7f940e6000, size 20480)

last unloaded kext at 48111600364863: com.apple.driver.AppleMikeyHIDDriver 124 (addr 0xffffff7f940e6000, size 12288)

loaded kexts:

com.apple.nke.rvi 2.0.0

com.apple.filesystems.smbfs 3.0.0

com.apple.filesystems.afpfs 11.0

com.apple.nke.asp-tcp 8.0.0

com.apple.driver.AppleHWSensor 1.9.5d0

com.apple.driver.AudioAUUC 1.70

com.apple.driver.AGPM 110.20.19

com.apple.driver.ApplePlatformEnabler 2.5.1d0

com.apple.driver.X86PlatformShim 1.0.0

com.apple.filesystems.autofs 3.0

com.apple.driver.AppleOSXWatchdog 1

com.apple.driver.AppleGraphicsDevicePolicy 3.7.7

com.apple.driver.AppleHDA 272.50

com.apple.driver.pmtelemetry 1

com.apple.driver.AppleUpstreamUserClient 3.6.1

com.apple.iokit.IOUserEthernet 1.0.1

com.apple.GeForce 10.0.6

com.apple.driver.AppleIntelHD5000Graphics 10.0.8

com.apple.iokit.IOBluetoothSerialManager 4.4.0f4

com.apple.Dont_Steal_Mac_OS_X 7.0.0

com.apple.driver.AppleHV 1

com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 4.4.0f4

com.apple.driver.AppleIntelFramebufferAzul 10.0.8

com.apple.driver.AppleLPC 3.1

com.apple.driver.AppleMCCSControl 1.2.13

com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0

com.apple.driver.AppleSMCLMU 208

com.apple.driver.AppleCameraInterface 5.41.0

com.apple.driver.AppleMuxControl 3.11.31

com.apple.driver.AppleThunderboltIP 3.0.8

com.apple.driver.AppleUSBCardReader 3.7.1

com.apple.driver.AppleUSBTCButtons 245.4

com.apple.driver.AppleUSBTCKeyboard 245.4

com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1

com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0

com.apple.BootCache 37

com.apple.iokit.IOAHCIBlockStorage 2.8.0

com.apple.driver.AppleAHCIPort 3.1.5

com.apple.driver.AirPort.Brcm4360 1000.13.1a3

com.apple.driver.AppleSmartBatteryManager 161.0.0

com.apple.driver.AppleACPIButtons 4.0

com.apple.driver.AppleRTC 2.0

com.apple.driver.AppleHPET 1.8

com.apple.driver.AppleSMBIOS 2.1

com.apple.driver.AppleACPIEC 4.0

com.apple.driver.AppleAPIC 1.7

com.apple.nke.applicationfirewall 163

com.apple.security.quarantine 3

com.apple.security.TMSafetyNet 8

com.apple.security.SecureRemotePassword 1.0

com.apple.kext.triggers 1.0

com.apple.driver.DspFuncLib 272.50

com.apple.kext.OSvKernDSPLib 525

com.apple.nvidia.driver.NVDAGK100Hal 10.0.6

com.apple.nvidia.driver.NVDAResman 10.0.6

com.apple.iokit.IOSurface 108.0.1

com.apple.iokit.IOSerialFamily 11

com.apple.driver.CoreCaptureResponder 1

com.apple.iokit.IOBluetoothHostControllerUSBTransport 4.4.0f4

com.apple.iokit.IOBluetoothFamily 4.4.0f4

com.apple.AppleGraphicsDeviceControl 3.11.31

com.apple.iokit.IOAcceleratorFamily2 203.7.1

com.apple.driver.AppleHDAController 272.50

com.apple.iokit.IOHDAFamily 272.50

com.apple.iokit.IOAudioFamily 203.8

com.apple.vecLib.kext 1.2.0

com.apple.driver.AppleSMBusController 1.0.14d1

com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0

com.apple.driver.AppleBacklightExpert 1.1.0

com.apple.iokit.IONDRVSupport 2.4.1

com.apple.driver.AppleGraphicsControl 3.11.31

com.apple.iokit.IOGraphicsFamily 2.4.1

com.apple.driver.X86PlatformPlugin 1.0.0

com.apple.driver.AppleSMC 3.1.9

com.apple.driver.IOPlatformPluginFamily 6.0.0d7

com.apple.iokit.IOSCSIBlockCommandsDevice 3.7.7

com.apple.iokit.IOUSBMassStorageDriver 1.0.0

com.apple.iokit.IOSCSIArchitectureModelFamily 3.7.7

com.apple.driver.usb.networking 5.0.0

com.apple.driver.usb.AppleUSBHub 1.0.1

com.apple.driver.AppleUSBMultitouch 250.4

com.apple.iokit.IOUSBHIDDriver 900.4.1

com.apple.driver.usb.AppleUSBHostCompositeDevice 1.0.1

com.apple.driver.CoreStorage 517

com.apple.iokit.IOAHCIFamily 2.8.0

com.apple.driver.AppleThunderboltDPInAdapter 4.1.2

com.apple.driver.AppleThunderboltDPAdapterFamily 4.1.2

com.apple.driver.AppleThunderboltPCIDownAdapter 2.0.2

com.apple.driver.AppleThunderboltNHI 4.0.1

com.apple.iokit.IOThunderboltFamily 5.0.6

com.apple.iokit.IO80211Family 1100.23

com.apple.driver.mDNSOffloadUserClient 1.0.1b8

com.apple.iokit.IONetworkingFamily 3.2

com.apple.driver.corecapture 1.0.4

com.apple.driver.usb.AppleUSBXHCIPCI 1.0.1

com.apple.driver.usb.AppleUSBXHCI 1.0.1

com.apple.iokit.IOUSBFamily 900.4.1

com.apple.iokit.IOUSBHostFamily 1.0.1

com.apple.driver.AppleUSBHostMergeProperties 1.0.1

com.apple.driver.AppleEFINVRAM 2.0

com.apple.driver.AppleEFIRuntime 2.0

com.apple.iokit.IOHIDFamily 2.0.0

com.apple.iokit.IOSMBusFamily 1.1

com.apple.security.sandbox 300.0

com.apple.kext.AppleMatch 1.0.0d1

com.apple.driver.AppleKeyStore 2

com.apple.driver.AppleMobileFileIntegrity 1.0.5

com.apple.driver.AppleCredentialManager 1.0

com.apple.driver.DiskImages 414

com.apple.iokit.IOStorageFamily 2.1

com.apple.iokit.IOReportFamily 31

com.apple.driver.AppleFDEKeyStore 28.30

com.apple.driver.AppleACPIPlatform 4.0

com.apple.iokit.IOPCIFamily 2.9

com.apple.iokit.IOACPIFamily 1.4

com.apple.kec.Libm 1

com.apple.kec.pthread 1

com.apple.kec.corecrypto 1.0

Model: MacBookPro11,3, BootROM MBP112.0138.B15, 4 processors, Intel Core i7, 2.3 GHz, 16 GB, SMC 2.19f12

Graphics: Intel Iris Pro, Intel Iris Pro, Built-In

Graphics: NVIDIA GeForce GT 750M, NVIDIA GeForce GT 750M, PCIe, 2048 MB

Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1600 MHz, 0x02FE, -

Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1600 MHz, 0x02FE, -

AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x134), Broadcom BCM43xx 1.0 (7.21.94.25.1a3)

Bluetooth: Version 4.4.0f4 16320, 3 services, 27 devices, 1 incoming serial ports

Network Service: USB Ethernet, Ethernet, en3

Network Service: Wi-Fi, AirPort, en0

Serial ATA Device: APPLE SSD SM0512F, 500.28 GB

USB Device: USB 3.0 Bus

USB Device: Card Reader

USB Device: Apple Internal Keyboard / Trackpad

USB Device: BRCM20702 Hub

USB Device: Bluetooth USB Host Controller

Thunderbolt Bus: MacBook Pro, Apple Inc., 17.1

Replies

Given all the changes in kernel development over the last N years, I’m not 100% sure how I’d go about symbolicating a kernel panic from an end user using public tools. Partly that’s because in almost all cases a kernel panic represents a bug in the kernel; even if user space code is doing something dumb, the kernel should protect itself from that.

Anyway, as to the panic log you posted, I used an Apple internal tool to get a backtrace of the crashing thread, which may offer some thoughts as to how your product is provoking this.

panic + 0xe7
kernel_trap + 0x91a
trap_from_kernel + 0x26
pfi_kif_update + 0x40
pf_ifaddr_hook + 0x49
inctl_ifaddr + 0x847
in_control + 0x968
ifioctl + 0x77c
ifioctllocked + 0x2f
utun_cleanup_family + 0x25d
utun_ctl_disconnect + 0x3d
ctl_disconnect + 0x51
soclose_locked + 0x51c
soclose + 0x9a
closef_locked + 0x170
close_internal_locked + 0x260
close_nocancel + 0xb4
unix_syscall64 + 0x251
hndl_unix_scall64 + 0x16

Still, this is clearly a bug in the kernel that Apple needs to fix (r. 18878714).

Share and Enjoy

Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thanks. Is there a way third party developers can symbolicate some part of the panic report to figure the location of the crash and avoid using the code which triggered the crash in the kernel. I can't imagine submitting panic reports everytime on this forum for symbolication.

Is there a way third party developers can symbolicate some part of the panic report to figure the location of the crash and avoid using the code which triggered the crash in the kernel.

As I said, I’m not up to speed on the state of third-party kernel symbolication tools.

Share and Enjoy

Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"