Mac kernel panic

mike · 7 April 2020 06:59

This is the first time it happened, but wanted to raise an issue so others might find it if it’s a repeated problem:

I closed the lid to my mac (OS X 10.15.3 (19D76)) and woke up to find it had kernel panic’d because of duplicacy.

Duplicacy is backing up to MS OneDrive.

panic(cpu 0 caller 0xffffff80020d33ce): "os_refcnt: overflow (rc=0xffffff804ea27e10)\n"@/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-6153.81.5/libkern/os/refcnt.c:58
Backtrace (CPU 0), Frame : Return Address
0xffffffa3e7d831b0 : 0xffffff800193bb2b 
0xffffffa3e7d83200 : 0xffffff8001a734d5 
0xffffffa3e7d83240 : 0xffffff8001a64f4e 
0xffffffa3e7d83290 : 0xffffff80018e2a40 
0xffffffa3e7d832b0 : 0xffffff800193b217 
0xffffffa3e7d833b0 : 0xffffff800193b5fb 
0xffffffa3e7d83400 : 0xffffff80020d2aa9 
0xffffffa3e7d83470 : 0xffffff80020d33ce 
0xffffffa3e7d83480 : 0xffffff8001a5c406 
0xffffffa3e7d834c0 : 0xffffff7f854e361c 
0xffffffa3e7d83500 : 0xffffff7f854e30bf 
0xffffffa3e7d83550 : 0xffffff7f854e386f 
0xffffffa3e7d83650 : 0xffffff7f854d8f67 
0xffffffa3e7d839a0 : 0xffffff8001b8bebe 
0xffffffa3e7d83b00 : 0xffffff8001b8b236 
0xffffffa3e7d83d10 : 0xffffff8001bb75fa 
0xffffffa3e7d83f40 : 0xffffff8001f9b08a 
0xffffffa3e7d83fa0 : 0xffffff80018e3206 
      Kernel Extensions in backtrace:
         com.apple.filesystems.ntfs(3.14.3)[3FE85505-B8F1-39CA-9328-A4CBD9FED0C7]@0xffffff7f854d1000->0xffffff7f8552cfff

BSD process name corresponding to current thread: duplicacy_osx_x6
Boot args: chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
19D76

Kernel version:
Darwin Kernel Version 19.3.0: Thu Jan  9 20:58:23 PST 2020; root:xnu-6153.81.5~1/RELEASE_X86_64
Kernel UUID: A8DDE75C-CD97-3C37-B35D-1070CC50D2CE
Kernel slide:     0x0000000001600000
Kernel text base: 0xffffff8001800000
__HIB  text base: 0xffffff8001700000
System model name: MacBookPro15,1 (Mac-937A206F2EE63C01)
System shutdown begun: NO

System uptime in nanoseconds: 628260740215415
last loaded kext at 615492219178495: @plugin.IOAVBDiscoveryPlugin	800.17 (addr 0xffffff7f87080000, size 73728)
last unloaded kext at 332485692474833: >usb.!UHostPacketFilter	1.0 (addr 0xffffff7f841ea000, size 24576)
loaded kexts:
net.sf.tuntaposx.tun	1.0
net.sf.tuntaposx.tap	1.0
com.getdropbox.dropbox.kext	1.10.3
ch.tripmode.TripModeNKE	2.0.2
com.intel.driver.EnergyDriver	3.5.5
@filesystems.msdosfs	1.10
>AudioAUUC	1.70
>usb.!UHostBillboardDevice	1.0
>usb.realtek8153patcher	5.0.0
@kext.AMDFramebuffer	3.0.5
@kext.AMDRadeonX4000	3.0.5
@kext.AMDRadeonServiceManager	3.0.5
>!AGraphicsDevicePolicy	4.7.2
@fileutil	20.036.15
@AGDCPluginDisplayMetrics	4.7.2
>!AHV	1
|IOUserEthernet	1.0.1
|IO!BSerialManager	7.0.3f5
>pmtelemetry	1
>AGPM	111.4.2
>X86PlatformShim	1.0.0
>!APlatformEnabler	2.7.0d0
@Dont_Steal_Mac_OS_X	7.0.0
>!AUpstreamUserClient	3.6.8
>AGDCBacklightControl	4.7.2
>BridgeAudioCommunication	6.66
>!A!IKBLGraphics	14.0.4
>!AThunderboltIP	3.1.3
@kext.AMD9500!C	3.0.5
>!ATopCaseHIDEventDriver	3430.1
>!AAVEBridge	6.1
>!AHIDALSService	1
>!A!ICFLGraphicsFramebuffer	14.0.4
>!AMuxControl2	4.7.2
>!AMCCSControl	1.13
>!ABridgeAudio!C	6.66
>!AGFXHDA	100.1.424
>!A!ISlowAdaptiveClocking	4.0.0
>!A!IPCHPMC	2.0.1
@filesystems.ntfs	3.14.3
@filesystems.autofs	3.0
>BCMWLANFirmware4355.Hashstore	1
>BCMWLANFirmware4364.Hashstore	1
>BCMWLANFirmware4377.Hashstore	1
@filesystems.hfs.kext	522.0.9
@BootCache	40
@!AFSCompression.!AFSCompressionTypeDataless	1.0.0d1
@!AFSCompression.!AFSCompressionTypeZlib	1.0.0
>!AVirtIO	1.0
>!ABCMWLANBusInterfacePCIe	1
@filesystems.apfs	1412.81.1
@private.KextAudit	1.0
>!ASmartBatteryManager	161.0.0
>!AACPIButtons	6.1
>!ASMBIOS	2.1
>!AACPIEC	6.1
>!AAPIC	1.7
$!AImage4	1
@nke.applicationfirewall	303
$TMSafetyNet	8
@!ASystemPolicy	2.0.0
|EndpointSecurity	1
@plugin.IOAVBDiscoveryPlugin	800.17
>!UMergeNub	900.4.2
>usb.cdc.acm	5.0.0
>usb.serial	6.0.0
>usb.cdc.ecm	5.0.0
>usb.IOUSBHostHIDDevice	1.2
>!UAudio	320.49
>!AXsanScheme	3
>usb.!UHub	1.2
@kext.AMDRadeonX4100HWLibs	1.0
@kext.AMDRadeonX4000HWServices	3.0.5
|IOAVB!F	800.17
>!ASSE	1.0
@!AGPUWrangler	4.7.2
>!ABacklightExpert	1.1.0
>!AActuatorDriver	3430.1
>!AHS!BDriver	3430.1
>IO!BHIDDriver	7.0.3f5
>!AMultitouchDriver	3430.1
>!AInputDeviceSupport	3430.1
>!AHIDKeyboard	209
|IOAccelerator!F2	438.3.1
>!AGraphicsControl	4.7.2
>!ASMBus!C	1.0.18d1
>X86PlatformPlugin	1.0.0
|IONDRVSupport	569.4
|IO!BHost!CUARTTransport	7.0.3f5
|IO!BHost!CTransport	7.0.3f5
>!A!ILpssUARTv1	3.0.60
>!A!ILpssUARTCommon	3.0.60
>!AOnboardSerial	1.0
@kext.AMDSupport	3.0.5
@!AGraphicsDeviceControl	4.7.2
|IOGraphics!F	569.4
|IOSlowAdaptiveClocking!F	1.0.0
>IOPlatformPlugin!F	6.0.0d8
@plugin.IOgPTPPlugin	810.1
|IOEthernetAVB!C	1.1.0
@kext.triggers	1.0
>usb.cdc.ncm	5.0.0
>usb.cdc	5.0.0
>usb.networking	5.0.0
>usb.!UHostCompositeDevice	1.2
|IOSurface	269.6
@filesystems.hfs.encodings.kext	1
|IOAudio!F	300.2
@vecLib.kext	1.2.0
>!ABCMWLANCore	1.0.0
>mDNSOffloadUserClient	1.0.1b8
>IOImageLoader	1.0.0
|IOSerial!F	11
|IO80211!FV2	1200.12.2b1
>corecapture	1.0.4
|IOSkywalk!F	1
>!AThunderboltPCIDownAdapter	2.5.4
>!AThunderboltDPInAdapter	6.2.5
>!AThunderboltDPAdapter!F	6.2.5
>!AHPM	3.4.4
>!A!ILpssI2C!C	3.0.60
>!A!ILpssDmac	3.0.60
>!A!ILpssI2C	3.0.60
>!AThunderboltNHI	5.8.6
|IOThunderbolt!F	7.6.0
|IOUSB!F	900.4.2
>usb.!UVHCIBCE	1.2
>usb.!UVHCI	1.2
>usb.!UVHCICommonBCE	1.0
>usb.!UVHCICommon	1.0
>!AEffaceableNOR	1.0
|IOBufferCopy!C	1.1.0
|IOBufferCopyEngine!F	1
|IONVMe!F	2.1.0
>usb.!UXHCIPCI	1.2
>usb.!UXHCI	1.2
>!AEFINVRAM	2.1
>!AEFIRuntime	2.1
>!ASMCRTC	1.0
|IOSMBus!F	1.1
|IOHID!F	2.0.0
$quarantine	4
$sandbox	300.0
@kext.!AMatch	1.0.0d1
>!AKeyStore	2
>!UTDM	489.80.2
|IOSCSIBlockCommandsDevice	422.0.2
>!ACredentialManager	1.0
>KernelRelayHost	1
>!ASEPManager	1.0.1
>IOSlaveProcessor	1
>!AFDEKeyStore	28.30
>!AEffaceable!S	1.0
>!AMobileFileIntegrity	1.0.5
@kext.CoreTrust	1
|CoreAnalytics!F	1
|IOTimeSync!F	810.1
|IONetworking!F	3.4
>DiskImages	493.0.0
|IO!B!F	7.0.3f5
|IO!BPacketLogger	7.0.3f5
|IOUSBMass!SDriver	157.40.7
|IOSCSIArchitectureModel!F	422.0.2
|IO!S!F	2.1
|IOUSBHost!F	1.2
>usb.!UCommon	1.0
>!UHostMergeProperties	1.2
>!ABusPower!C	1.0
|IOReport!F	47
>!AACPIPlatform	6.1
>!ASMC	3.1.9
>watchdog	1
|IOPCI!F	2.9
|IOACPI!F	1.4
@kec.pthread	1
@kec.corecrypto	1.0
@kec.Libm	1

saspus · 7 April 2020 07:09

No. This panic has nothing to do with duplicacy. The kernel extension in the stack is com.apple.filesystems.ntfs, it’s an NTFS filesystem driver.

What made you think it’s duplicacy!? You can reproduce the same behavior by copying all files to /dev/null if you wish. Usermode process cannot cause kernel panic. Bug in the drivers – can.

What likely happened is your NTFS volume is corrupted/in the inconsistent state and the filesystem driver does not handle that well. By the way the panic is deliberate as you can see from the panic message: “os_refcnt: overflow” – the driver detected inconsistency and to protect your data and not mess it up further preemptively panicked machines. Questionable choice for readonly filesystem – but oh well. It’s a correct behavior for read-write filesystems.

So, I would proceed as follows:

Repot the panic to Apple – if the NTFS driver is written by Apple. Or are you using third party one?
Connect your disk to actual windows machine and run chkdsk /f on it to fix inode references and bring the filesytem into consistent state.
Retry your backup.
(Generally stop using NTFS on macOS)

On a separate note – what are you boot-args for?

chunklist-security-epoch=0 -chunklist-no-rev2-dev

And another thing: you seem to have quite a few questionable kexts loaded – either of them could be a culprit by the way. Memory is all shared in the kernel so bad kext can stomp all over the place and cause corruptions somewhere else, where you least expect.

For example “ch.tripmode.TripModeNKE” – what is this and why is it loaded into kernel?

I would remove all that crap, fix the filesystem and see if it ever reproduces again.

mike · 10 April 2020 00:19

thank you so much for your extensive response!

I thought it was duplicacy because:

BSD process name corresponding to current thread: duplicacy_osx_x6

I didn’t change my bootargs so I’m not sure how they’re non-standard.

I have a couple of weird kexts, the one you mention is a program that is similar to the little snitch. My understand that in 10.16 there will be a nicer API for secure network filtering but not in 10.15 yet.

Haven’t experienced the problem since. Still kind of curious why (if?), from my understanding, duplicacy was snooping into my ntfs volume despite not being part of my backup.