[False alarm] Kernel panics since Little Snitch 4.1.3 (5187)

General discussions about Little Snitch
Posts: 9
Joined: Sun Apr 13, 2014 1:02 am

[False alarm] Kernel panics since Little Snitch 4.1.3 (5187)

Postby mcgroarty » Mon Sep 10, 2018 8:40 am

Edit: False alarm. See later comment.

I originally mailed this to support, but the support email address rejects GMail as a spammer:

Your message to (support email) has been blocked. See technical details below for more information.
The response from the remote server was:
554 5.7.1 Service unavailable; Client host [] blocked using ix.dnsbl.manitu.net

Subject: Kernel panics since Little Snitch 4.1.3 (5187)

Which Little Snitch version are you running?
Little Snitch 4.1.3 (5187)

Which macOS Version are you running?
High Sierra 10.13.6 (17G65)

Your message:
I began having kernel panics when Little Snitch 4.1.3 (5187) was released. They occured 3-4 times per week, sometimes twice per day, and always while using Google Chrome. Uninstalling Little Snitch nearly a week ago has given me a crash-free experience again.

The crashes aren't attributed to Little Snitch, always the WindowServer process. But I wonder if Little Snitch might be stepping on other kernel memory. In the release notes, I saw that there was a change wherein connections initiated by the kernel might generate connection alerts now.

The other third-party kernel extensions on my system are for an Areca storage device and Parallels. Uninstalling Parallels (including the kernel extensions) did not stop the crashes. I have not tried uninstalling the Areca driver as I need it for work, however the panics have stopped with only that extension installed now.

If it helps, here is an example panic:

*** Panic Report ***
panic(cpu 6 caller 0xffffff800298776f): Kernel trap at 0xffffff80027930c5, type 13=general protection, registers:
CR0: 0x0000000080010033, CR2: 0x0000000107f74b50, CR3: 0x000000082568c065, CR4: 0x00000000001627e0
RAX: 0x0000000000000010, RBX: 0xffffff80489c3de0, RCX: 0x000000000000001f, RDX: 0x0000000000000180
RSP: 0xffffffa3dbd938a8, RBP: 0xffffffa3dbd938e0, RSI: 0xffffff833eac0b20, RDI: 0xffffff833eac0b30
R8: 0xffffff80489c3de0, R9: 0x00000000000004bb, R10: 0x00000004a8c70000, R11: 0xffffff804fcc660c
R12: 0x0000000000004a38, R13: 0x0000000000000600, R14: 0x00000000000004a3, R15: 0x00000004a8dbffff
RFL: 0x0000000000010686, RIP: 0xffffff80027930c5, CS: 0x0000000000000008, SS: 0x0000000000000010
Fault CR2: 0x0000000107f74b50, Error code: 0x0000000000000000, Fault CPU: 0x6, PL: 0, VF: 0

Backtrace (CPU 6), Frame : Return Address
0xffffff800274f290 : 0xffffff800286c1c6
0xffffff800274f2e0 : 0xffffff8002995274
0xffffff800274f320 : 0xffffff8002987544
0xffffff800274f390 : 0xffffff800281e1e0
0xffffff800274f3b0 : 0xffffff800286bc3c
0xffffff800274f4e0 : 0xffffff800286b9fc
0xffffff800274f540 : 0xffffff800298776f
0xffffff800274f6b0 : 0xffffff800281e1e0
0xffffff800274f6d0 : 0xffffff80027930c5
0xffffffa3dbd938e0 : 0xffffff8002eb0e16
0xffffffa3dbd93930 : 0xffffff7f83a29c6a
0xffffffa3dbd93970 : 0xffffff7f83a402a2
0xffffffa3dbd939a0 : 0xffffff7f83a00ad8
0xffffffa3dbd939e0 : 0xffffff7f83a19395
0xffffffa3dbd93a20 : 0xffffff7f83a1cacb
0xffffffa3dbd93a90 : 0xffffff7f83a1dbc7
0xffffffa3dbd93ad0 : 0xffffff8002ec1978
0xffffffa3dbd93b20 : 0xffffff7f83a1dd3e
0xffffffa3dbd93b70 : 0xffffff8002eca567
0xffffffa3dbd93cb0 : 0xffffff8002942bf4
0xffffffa3dbd93dc0 : 0xffffff80028716e0
0xffffffa3dbd93e10 : 0xffffff800284ea3d
0xffffffa3dbd93e60 : 0xffffff800286154b
0xffffffa3dbd93ef0 : 0xffffff800297171d
0xffffffa3dbd93fa0 : 0xffffff800281e9e6
Kernel Extensions in backtrace:
dependency: com.apple.driver.AppleMobileFileIntegrity(1.0.5)[4FAE8181-B0B4-3A30-B0F3-77F48D2486E5]@0xffffff7f83979000
dependency: com.apple.iokit.IOSurface(211.15)[37BCC686-AF99-3381-AC4F-E54A347E0F40]@0xffffff7f8398e000
dependency: com.apple.iokit.IOPCIFamily(2.9)[AEA4C7F5-CCB0-338B-B471-CF28A9792522]@0xffffff7f83094000
dependency: com.apple.iokit.IOGraphicsFamily(519.20)[0E507098-E375-39B7-9AE2-AFF2C7A5D961]@0xffffff7f839a9000

BSD process name corresponding to current thread: WindowServer

Mac OS version:

Kernel version:
Darwin Kernel Version 17.7.0: Thu Jun 21 22:53:14 PDT 2018; root:xnu-4570.71.2~1/RELEASE_X86_64
Kernel UUID: 1AE5ACFD-3B6F-3D74-AD52-31F1430DBC6F
Kernel slide: 0x0000000002600000
Kernel text base: 0xffffff8002800000
__HIB text base: 0xffffff8002700000
System model name: iMac15,1 (Mac-FA842E06C61E91C5)

System uptime in nanoseconds: 3767916782061
last loaded kext at 263316261072: com.apple.filesystems.msdosfs 1.10 (addr 0xffffff7f86f3d000, size 69632)
loaded kexts:
com.parallels.kext.vnic 14.0.0 45124
com.parallels.kext.netbridge 14.0.0 45124
com.parallels.kext.hypervisor 14.0.0 45124
at.obdev.nke.LittleSnitch 5187
com.Areca.ArcMSR 1.3.9
com.apple.filesystems.msdosfs 1.10
com.apple.filesystems.afpfs 11.1
com.apple.nke.asp-tcp 8.0.2
com.apple.filesystems.smbfs 3.2.3
com.apple.driver.AppleBluetoothMultitouch 92
com.apple.driver.ApplePlatformEnabler 2.7.0d0
com.apple.driver.AGPM 110.23.37
com.apple.driver.X86PlatformShim 1.0.0
com.apple.filesystems.autofs 3.0
com.apple.driver.AppleMikeyHIDDriver 131
com.apple.driver.AppleMikeyDriver 281.52
com.apple.driver.AppleHDAHardwareConfigDriver 281.52
com.apple.driver.AppleHDA 281.52
com.apple.driver.AppleUpstreamUserClient 3.6.5
com.apple.kext.AMDFramebuffer 1.6.8
com.apple.kext.AMDRadeonX4000 1.6.8
com.apple.driver.AppleGraphicsDevicePolicy 3.20.13
com.apple.AGDCPluginDisplayMetrics 3.20.13
com.apple.driver.AppleHV 1
com.apple.iokit.IOUserEthernet 1.0.1
com.apple.iokit.IOBluetoothSerialManager 6.0.7f10
com.apple.driver.pmtelemetry 1
com.apple.driver.AGDCBacklightControl 3.20.13
com.apple.driver.AppleIntelHD5000Graphics 10.3.6
com.apple.Dont_Steal_Mac_OS_X 7.0.0
com.apple.driver.eficheck 1
com.apple.driver.AppleBacklight 170.12.6
com.apple.kext.AMD9000Controller 1.6.8
com.apple.driver.ACPI_SMC_PlatformPlugin 1.0.0
com.apple.driver.AppleFIVRDriver 4.1.0
com.apple.driver.AppleLPC 3.1
com.apple.driver.AppleMCCSControl 1.5.5
com.apple.driver.AppleSMCLMU 211
com.apple.driver.AudioAUUC 1.70
com.apple.driver.AppleOSXWatchdog 1
com.apple.driver.AppleIntelFramebufferAzul 10.3.6
com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0
com.apple.driver.AppleThunderboltIP 3.1.1
com.apple.driver.CoreStorageFsck 546.50.1
com.apple.iokit.IOBluetoothUSBDFU 6.0.7f10
com.apple.iokit.SCSITaskUserClient 404.30.2
com.apple.driver.AppleFileSystemDriver 3.0.1
com.apple.filesystems.hfs.kext 407.50.6
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1
com.apple.BootCache 40
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0
com.apple.AppleSystemPolicy 1.0
com.apple.filesystems.apfs 748.51.0
com.apple.driver.AppleSDXC 1.7.6
com.apple.iokit.AppleBCM5701Ethernet 10.3.1
com.apple.driver.AirPort.BrcmNIC 1241.31.1a9
com.apple.driver.AppleAHCIPort 329.50.2
com.apple.driver.AppleACPIButtons 6.1
com.apple.driver.AppleRTC 2.0
com.apple.driver.AppleHPET 1.8
com.apple.driver.AppleSMBIOS 2.1
com.apple.driver.AppleACPIEC 6.1
com.apple.driver.AppleAPIC 1.7
com.apple.nke.applicationfirewall 183
com.apple.security.TMSafetyNet 8
com.apple.security.quarantine 3
com.apple.security.SecureRemotePassword 1.0
com.apple.driver.IOBluetoothHIDDriver 6.0.7f10
com.apple.driver.AppleMultitouchDriver 1404.4
com.apple.driver.AppleInputDeviceSupport 1404.3
com.apple.driver.usb.cdc.acm 5.0.0
com.apple.kext.triggers 1.0
com.apple.driver.DspFuncLib 281.52
com.apple.kext.OSvKernDSPLib 526
com.apple.kext.AMDRadeonX4070HWLibs 1.0
com.apple.kext.AMDRadeonX4000HWServices 1.6.8
com.apple.driver.AppleGraphicsControl 3.20.13
com.apple.iokit.IOAVBFamily 680.2
com.apple.plugin.IOgPTPPlugin 680.15
com.apple.driver.AppleSSE 1.0
com.apple.iokit.IOSerialFamily 11
com.apple.driver.AppleBacklightExpert 1.1.0
com.apple.driver.AppleSMBusPCI 1.0.14d1
com.apple.iokit.IONDRVSupport 519.20
com.apple.driver.IOPlatformPluginLegacy 1.0.0
com.apple.driver.AppleHDAController 281.52
com.apple.iokit.IOHDAFamily 281.52
com.apple.driver.AppleSMBusController 1.0.18d1
com.apple.kext.AMDSupport 1.6.8
com.apple.iokit.IOAcceleratorFamily2 378.26
com.apple.iokit.IOSurface 211.15
com.apple.driver.X86PlatformPlugin 1.0.0
com.apple.driver.IOPlatformPluginFamily 6.0.0d8
com.apple.AppleGPUWrangler 3.20.13
com.apple.AppleGraphicsDeviceControl 3.20.13
com.apple.iokit.IOGraphicsFamily 519.20
com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0
com.apple.driver.AppleThunderboltEDMSink 4.1.4
com.apple.driver.usb.cdc.ecm 5.0.0
com.apple.driver.usb.cdc.ncm 5.0.0
com.apple.driver.CoreStorage 546.50.1
com.apple.driver.AppleHIDKeyboard 205
com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 6.0.7f10
com.apple.iokit.IOBluetoothHostControllerUSBTransport 6.0.7f10
com.apple.iokit.IOBluetoothHostControllerTransport 6.0.7f10
com.apple.iokit.IOBluetoothFamily 6.0.7f10
com.apple.driver.usb.IOUSBHostHIDDevice 1.2
com.apple.driver.AppleUSBAudio 312.6
com.apple.iokit.IOAudioFamily 206.5
com.apple.vecLib.kext 1.2.0
com.apple.driver.usb.cdc 5.0.0
com.apple.driver.usb.networking 5.0.0
com.apple.driver.usb.AppleUSBHostCompositeDevice 1.2
com.apple.driver.usb.AppleUSBHub 1.2
com.apple.filesystems.hfs.encodings.kext 1
com.apple.driver.AppleUSBMergeNub 900.4.1
com.apple.driver.AppleThunderboltDPInAdapter 5.5.5
com.apple.driver.AppleThunderboltDPOutAdapter 5.5.5
com.apple.driver.AppleThunderboltDPAdapterFamily 5.5.5
com.apple.driver.AppleThunderboltPCIUpAdapter 2.1.3
com.apple.driver.AppleThunderboltPCIDownAdapter 2.1.3
com.apple.driver.AppleXsanScheme 3
com.apple.iokit.IOSCSIParallelFamily 3.0.0
com.apple.driver.AppleThunderboltNHI 4.7.2
com.apple.iokit.IOThunderboltFamily 6.7.8
com.apple.iokit.IOAHCIBlockStorage 301.40.2
com.apple.iokit.IOEthernetAVBController 1.1.0
com.apple.iokit.IO80211Family 1200.12.2
com.apple.driver.mDNSOffloadUserClient 1.0.1b8
com.apple.driver.corecapture 1.0.4
com.apple.iokit.IOAHCIFamily 288
com.apple.driver.AppleIntelLpssGspi 3.0.60
com.apple.driver.usb.AppleUSBXHCIPCI 1.2
com.apple.driver.usb.AppleUSBXHCI 1.2
com.apple.driver.usb.AppleUSBHostPacketFilter 1.0
com.apple.iokit.IOUSBFamily 900.4.1
com.apple.driver.AppleUSBHostMergeProperties 1.2
com.apple.driver.AppleEFINVRAM 2.1
com.apple.driver.AppleEFIRuntime 2.1
com.apple.iokit.IOSMBusFamily 1.1
com.apple.iokit.IOHIDFamily 2.0.0
com.apple.security.sandbox 300.0
com.apple.kext.AppleMatch 1.0.0d1
com.apple.driver.DiskImages 480.60.1
com.apple.driver.AppleFDEKeyStore 28.30
com.apple.driver.AppleEffaceableStorage 1.0
com.apple.driver.AppleKeyStore 2
com.apple.driver.AppleUSBTDM 439.70.3
com.apple.driver.AppleMobileFileIntegrity 1.0.5
com.apple.iokit.IOUSBMassStorageDriver 140.70.2
com.apple.iokit.IOSCSIBlockCommandsDevice 404.30.2
com.apple.iokit.IOSCSIArchitectureModelFamily 404.30.2
com.apple.iokit.IOStorageFamily 2.1
com.apple.driver.AppleCredentialManager 1.0
com.apple.driver.KernelRelayHost 1
com.apple.iokit.IOUSBHostFamily 1.2
com.apple.driver.usb.AppleUSBCommon 1.0
com.apple.driver.AppleBusPowerController 1.0
com.apple.driver.AppleSEPManager 1.0.1
com.apple.driver.IOSlaveProcessor 1
com.apple.iokit.IOReportFamily 31
com.apple.iokit.IOTimeSyncFamily 680.15
com.apple.iokit.IONetworkingFamily 3.4
com.apple.driver.AppleACPIPlatform 6.1
com.apple.driver.AppleSMC 3.1.9
com.apple.iokit.IOPCIFamily 2.9
com.apple.iokit.IOACPIFamily 1.4
com.apple.kec.pthread 1
com.apple.kec.Libm 1
com.apple.kec.corecrypto 1.0


System Profile:
Serial ATA Device: APPLE SSD SM1024F, 1 TB
Bluetooth: Version 6.0.7f10, 3 services, 27 devices, 1 incoming serial ports
Model: iMac15,1, BootROM IM151.0217.B00, 4 processors, Intel Core i7, 4 GHz, 32 GB, SMC 2.23f11
Thunderbolt Bus: iMac, Apple Inc., 26.1
Boot Volume File System Type: apfs
Graphics: AMD Radeon R9 M295X, AMD Radeon R9 M295X, PCIe
USB Device: USB 3.0 Bus
USB Device: USB3.0 Hub
USB Device: USB3.0 Hub
USB Device: USB3.0 Hub
USB Device: USB3.0 Hub
USB Device: BRCM20702 Hub
USB Device: Bluetooth USB Host Controller
USB Device: FaceTime HD Camera (Built-in)
USB Device: USB2.0 Hub
USB Device: USB2.0 Hub
USB Device: iPhone
USB Device: Keyboard Hub
USB Device: HyperFIDO Token
USB Device: Apple Keyboard
USB Device: Plantronics .Audio 400 DSP
USB Device: AT2020USB+
USB Device: USB2.0 Hub
USB Device: USB2.0 Hub
USB Device: MG5300 series
USB Device: iPhone
Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1600 MHz, 0x80AD, 0x484D54343147533641465238412D50422020
Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1600 MHz, 0x80AD, 0x484D54343147533641465238412D50422020
Memory Module: BANK 0/DIMM1, 8 GB, DDR3, 1600 MHz, 0x80AD, 0x484D54343147533641465238412D50422020
Memory Module: BANK 1/DIMM1, 8 GB, DDR3, 1600 MHz, 0x80AD, 0x484D54343147533641465238412D50422020
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x142), Broadcom BCM43xx 1.0 (
Network Service: Ethernet, Ethernet, en0
Network Service: AirPort, AirPort, en1
Network Service: iPhone 5, Ethernet, en17
Network Service: iPhone 10, Ethernet, en23
PCI Card: pci17d3,1880, RAID Controller, Thunderbolt@193,0,0
Thunderbolt Device: ARC8050-T2, Areca, 1, 22.1
Last edited by mcgroarty on Tue Sep 11, 2018 1:14 am, edited 1 time in total.

Objective Development
Objective Development
Posts: 1436
Joined: Thu Nov 09, 2006 11:46 am

Re: Kernel panics since Little Snitch 4.1.3 (5187)

Postby christian » Mon Sep 10, 2018 10:51 am

mcgroarty wrote:I originally mailed this to support, but the support email address rejects GMail as a spammer:

Your message to (support email) has been blocked. See technical details below for more information.
The response from the remote server was:
554 5.7.1 Service unavailable; Client host [] blocked using ix.dnsbl.manitu.net

Sorry about that! ix.dnsbl.manitu.net is a short term blacklist. If spam is reported to originate at an IP address, it includes this address for about an hour in the blacklist. So it makes definitely sense to retry if this error occurs.

Regarding the kernel panics:

As far as I can see, the crash occurs in the kernel as a consequence to a call from the graphics card driver. Since kernel memory is shared among the kernel and all modules, it is, in principle, possible that Little Snitch causes this by corrupting kernel memory. Since the kernel extension is such a critical component, we have run extensive tests with memory debug libraries and even with a special kernel from Apple, built for debugging kernel memory issues. All these tests revealed nothing in Little Snitch.

There is an other known issue, though, which MIGHT be related. Not a kernel issue, though: Under circumstances we cannot reproduce (yet), one of our processes (the process responsible for showing alerts) gets stuck in a call to the graphics driver. We have a mechanism which detects this hang and restarts the process. Similarly, on some systems, Little Snitch Network Monitor leaks large chunks of memory in Core Animation or Core Graphics. The two issues seem to be related, if a customer suffers from one of them, they likely experience the other issue as well. We have no reports so far that these issues can cause a kernel panic, though. But at least the same subsystem (the graphics driver) is affected.

Do you have more of these panic logs? If yes, please mail them to us in support (with a link to this forum thread). Your mail server should have dropped out of the blacklist meanwhile.

Posts: 9
Joined: Sun Apr 13, 2014 1:02 am

Re: [False alarm] Kernel panics since Little Snitch 4.1.3 (5187)

Postby mcgroarty » Tue Sep 11, 2018 1:17 am

Another panic eventually happened. It took longer to happen once I uninstalled Little Snitch, at least a full week now. But these crashes have been random enough that the quiet period was probably just a roll of the dice.

A nice and expensive hardware problem is the most likely explanation at this point. But on the positive side, I can reinstall Little Snitch on my next machine without worry. Maybe I'll get lucky and they'll announce new Mac models tomorrow. Wish me luck?

I've changed the title of this thread to reflect that this DOES NOT appear to be a Little Snitch problem.

Objective Development
Objective Development
Posts: 1436
Joined: Thu Nov 09, 2006 11:46 am

Re: [False alarm] Kernel panics since Little Snitch 4.1.3 (5187)

Postby christian » Tue Sep 11, 2018 9:33 am

Thanks for the update!

If you have such a hardware problem, it's likely that Little Snitch Network Monitor triggers it with all the animations taking place all over the time.

We all hope for some cool and affordable new hardware :-)

Rank 3
Rank 3
Posts: 109
Joined: Mon Jul 02, 2007 9:25 am

Re: [False alarm] Kernel panics since Little Snitch 4.1.3 (5187)

Postby rsblanchard » Fri Sep 14, 2018 4:21 pm

Try buying TechToolPro v10.0.1, from Micromat.com , and run the RAM-test and disk-bad-sector tests -- they identify bad locations on both, and, hopefully, help improve performance, when they take those bad-locations, out-of-operation, and replace them, with "spare"-good-ones .

Return to “Little Snitch General”

Who is online

Users browsing this forum: No registered users and 4 guests