Removed Kexts Still Loading in Big Sur 20A5343i

Question

Created Aug ’20

Replies 6

Boosts 0

Views 7.7k

Participants 7

I am having kernel panics in Big Sur 20A5343i and the panic log is indicating involvement with Soundflower and an old Blackmagic Framebuffer kext.

The problem is that while I've deleted these kexts from /Library/Extensions, they are still getting loaded.

I found them also in /Library/StagedExtensions/Library/Extensions/ and removed them from there as well.

But still, they are getting loaded.

Code Block $ sudo kextstat | grep -i soundfl
  168    0 0xffffff7fa0271000 0x3000     0x3000     com.Cycling74.driver.Soundflower (2) 2D779840-7439-31E5-8A66-D786C3F47B75 <94 6 5 3>
$ sudo kextstat | grep -i blackmag
  167    0 0xffffff7f9ff1f000 0x2000     0x2000     com.blackmagic-design.desktopvideo.iokit.framebufferdriver (10.5.2) C260C085-A85B-363A-A9B6-74336D16BC49 <115 6 5 3>

I think they are in a cache, but kmutil won't update the boot cache:

Code Block $ sudo kmutil install --update-all --force --volume-root /Volumes/Macintosh\ HD
checking collections...
Warning: com.apple.driver.KextExcludeList was not found!
considering release out-of-date because of --force
rebuilding release collections: boot, system
rebuilding release collections:
	boot kernel collection
	system kext collection
failed to build release collection:
	Invalid argument: Writing boot kernel collection failed.
failed to build any collections (expected: 1)
kmutil done

Has anyone found how to update the kext cache in the boot kernel collection in Big Sur?

Boost

Answer 1

mdolan OP

Aug ’20

This is from the release notes (not sure which release) and I don't know if it's still true:

Moving a kernel extension bundle out of /Library/Extensions might not completely uninstall it. (64331929
Workaround:
Remove the extension from /Library/Extensions.
Boot to macOS Recovery.
Run Terminal.
Enter the command kmutil invoke-panic-medic.
Restart your Mac.
Follow the prompt to open System Preferences and navigate to Security & Privacy.
Follow the prompt to restart.

0

Answer 2

rlf613 OP

Nov ’20

I desperately need help with this too.

I have a system kext that is causing my Mac to crash always instantly. I have managed to remove the .kext file from System/Library/Extensions but the kext is still loaded in the boot kernel collection. How do I remove it from this is Big Sur?

Any help is appreciated.

0

Answer 3

aredos OP

Nov ’20

This is also happening in the release version. Did anyone find a way to remove or disable a specific kext?

In my situation the /System/Library/Extensions/AppleGFXHDA.kext is giving me crashes since High Sierra. When connecting or unplugging from an external display I sometimes get a kernel panic and sometimes it works.

The bug is still not fixed but a good workaround was to remove the kernel extension from /System/Library/Extensions and the problem was gone until the next system update. Now it appears that even when I remove the kext, it still magically re-appears after a reboot.

I tried the kmutil invoke-panic-medic suggestion, but the command failed for me.

0

Answer 4

IoannisTzon OP

Nov ’20

I can't delete a kext, I can't install a kext (RazerHid.kext) even when whitelisting it's TeamID. There's so much stuff we can't do on Terminal any more as power users. I think Big Sur just killed macOS. Spotlight is also useless now. I think Catalina is the solution to all the problems we're facing on Big Sur. And I thought software updates add functionality...

0

Answer 5

HStriepe OP

Nov ’20

"sudo kmutil clear-staging" followed by reboot might help.

0

Answer 6

marekful OP

May ’21

I had the problem of kexts still loading after I deleted a 3rd party software that had no uninstaller.

A good advice in the first place is to use ForkLift2 to remove such software. (When you try to delete something from the Applications folder from ForkLift2, it will search for kexts it uses and offer to remove those too along with some other things like libs.)

If you are past this point and the kexts are still loading for the removed software and they are loaded from StagedExtensions, then disable SIP in recovery mode, reboot, and 'sudo kextunload' then 'sudo rm -rf' the extensions in question. Then do 'sudo kmutil clear-staging' and reboot.

I also recommend Objective-See KextViewer to ease finding and getting details about loaded kexts. It is a free, open-source software.

Once rebooted the extensions likely will still load, but this time not from StagedExtensions, but from their normal location, e.g. '/Library/Application Support/...' or somewhere else. Repeat the kextunload and rm -rf for them and reboot.

This procedure helped me get rid of them for good.

Don't forget to enable SIP once you finished!

0