Kernel panic on macOS: leaked retain on IOMediaBSDClient after dismounting an encrypted partition prevents device termination
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
The report provides reproduction steps and IOKit evidence, but names no VeraCrypt source files or tests. Start by tracing the macOS mount and dismount paths for the encrypted partition’s IOMediaBSDClient retain; verify the retain is released after dismount and the device can terminate after removal. No test entry point is identified, so reproduce with the reported mount, dismount, removal, and sleep sequence.
Written by the indexing model from the issue text.
Description
Environment
- MacBook Air 15" (Apple M4, ARM64, T8132)
- macOS 26.6.2 (build 25G83), Darwin 25.6.0
- VeraCrypt 1.26.29
- FUSE backend: <FUSE-T.>
- Volume: external 14 TB USB HDD, whole-partition encryption
(GPT: Microsoft Reserved + Microsoft Basic Data) - No third-party kernel extensions loaded (verified with kmutil),
SIP enabled, full boot security
Summary
On dismount, VeraCrypt does not release a retain it holds on the
IOMediaBSDClient object of the underlying encrypted partition. The
object stays over-retained. When the physical device is later removed,
that object cannot finish termination and remains stuck in
inactive, busy 1 indefinitely. The next system sleep triggers a
60-second IOKit busy timeout and the machine panics.
This is specific to laptops, where sleep/wake happens routinely
(closing the lid). On a desktop that never sleeps the leak would stay
invisible.
Steps to reproduce
- Reboot. Connect the external drive, do not mount anything.
- Mount the encrypted partition in VeraCrypt.
- Dismount it in VeraCrypt (not via Finder). Optionally quit
VeraCrypt entirely — makes no difference. - Power the drive off (or unplug it).
- Close the lid for 5–10 minutes, then open it.
- Kernel panic within ~2 minutes of wake.
Evidence
Output of ioreg -c IOMediaBSDClient -r -w0 | grep -i IOMediaBSDClient
at each stage (external drive objects only):
- After reboot, drive off: 5 objects (internal disks), all
busy 0 - Drive powered on, nothing mounted: 3 new objects appear
(whole disk + 2 partitions), allactive, busy 0, retain 6 - Volume mounted in VeraCrypt: 1 more object appears (the decrypted
volume), AND the encrypted partition's object goes retain 6 -> 7 - Dismounted in VeraCrypt: the decrypted volume object is gone
(clean), but the encrypted partition's object still shows retain 7 - Drive powered off: the other two objects terminate cleanly and
disappear; the encrypted partition's object remains:
+-o IOMediaBSDClient <class IOMediaBSDClient, id 0x1000013f9,
!registered, !matched, inactive, busy 1 (9383 ms), retain 7>
The busy timer keeps counting indefinitely (observed past 264000 ms).
diskutil eject on that disk fails. lsof on /dev/diskN and
/dev/rdiskN returns nothing, so this is a kernel-level retain, not an
open file descriptor. Only a reboot clears it.
Resulting panic
panic(cpu 0 caller 0x...): busy timeout[1], (60s):
'IOMediaBSDClient' (1,1812001) @IOService.cpp:5986
Panicked task ... pid 541: watchdogd
What was ruled out
- Machine and OS: a session with no external drive sleeps and wakes
normally, repeatedly - The drive and its enclosure: powering it on and off without ever
mounting the volume causes no leak and no panic - Third-party kernel extensions: none are loaded
- Dismount order: same result whether dismounted via Finder first or
in VeraCrypt only - Quitting the application: does not release the retain
The leak occurs at dismount, before the device is removed. The extra
retain is taken at mount time and never returned.
Workaround
Leaving the drive powered on after dismount avoids the panic entirely:
sleep and wake work normally. The panic only occurs if the device is
removed after a mount/dismount cycle.
- Dominant language
- C
- Stars
- 11.7k
- Forks
- 1.4k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 28
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from veracrypt/VeraCrypt
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
bug
Difficulty 5/5 Over a week Newbie friendliness 32/100
veracrypt/VeraCrypt#1995 · 1 comment · 1 reaction ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
veracrypt/VeraCrypt#1993 · 2 comments ·
Maintainers usually reply within 1 day
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 55/100
veracrypt/VeraCrypt#1991 · 1 comment ·
Maintainers usually reply within 1 day
All issues in veracrypt/VeraCrypt
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug game: 01008BA02525A000 ios
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
area/ysql kind/bug priority/medium status/awaiting-triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
yugabyte/yugabyte-db#37523 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
Maintainers usually reply within 3 days
-
Difficulty 1/5 Under an hour Newbie friendliness 65/100
ly05010419/MacNativeGames#2079 ·
Maintainers usually reply within 1 day