VM Ware Fusion potentially causes macOS 10.15.6 to crash

[Alex_Ma]

I recently upgraded to macOS 10.15.6. Now if I leave VM Ware Fusion running while leaving my mac for some time, e.g. - for a night, the system crashes. This did not happen with the older macOS 10.15.5 version.

VM Ware Fusion version: Professional Version 11.5.5 (16269456)

macOS Catalina version: 10.15.6 (19G73)

[DanieDarko]

The only way I can think of is disassembling the two versions and comparing them with a diff.

This way one could publish the solution the kernel memory leak and nudge Apple into releasing a fix.

My workaround is still running without errors.

I copied the Sandbox.kext from another Macbook running 10.15.5, but I will have a look at the Combo Update and if it'Äs possible to extract the Kext from there.

[amjbecker]

I was able to extract it from the 10.5.5 combo update using Pacifist.

It looks like the "supplemental" update has an identical version as it.

[rwes]

I couldn't keep working the way I was; spend a lot of time side-by-side with 1 VM up (Windows 10). I'd jump on conference calls thinking: "hope I can get through this call", and be ready to jump on the call from iPad or iPhone (if needed).

I went the MDS route provided (Thanks!) by someone earlier in this thread and back to 10.15.5.

Hoping this fixes as it has for others, and if so, I'll only be sad I didn't do it a bit sooner. 

[DanieDarko]

Just did this myself and can confirm, the Sandbox.kext can be extracted from macOS Combo update 10.15.5:

https://updates.cdn-apple.com/2020/macos/001-12346-20200528-c8559404-82ce-4926-a8cf-a2ff6630fe44/mac...

Just extract it with pkgutil --expand-full macOSUpdCombo10.15.5.pkg

or to extract it with any other util and extract macOSUpdCombo10.15.5.pkg/Payload using pbzx.

Afterwards you should have the System/Library/Extensions/Sandbox.kext and usr/libexec/sandboxd directory structures.

sandboxd also differs, so maybe it's a good idea to replace both...

To replace them just save these files somewhere on your disk and reboot into recovery mode, holding Cmd+R.

Then you just need to mount your system disk using Disk utility and then launch the terminal to copy the files into place.

Don't forget to check the ownership and permissions!

[PRware7]

I ran into this issue and found that the VMware Fusion.app was set to read only for wheel and everyone. I changed both wheel and everyone to read/write and the application launched. So go to Applications > VMWare Fusion.app > Right Click > Get Info and change the permissions to read/write.  Hope this helps.

[rossco_au]

Wrong thread PRware7? 

[PRware7]

Probably, VMWare fusion was crashing for me and thought this info may help.

[Alex_Ma]

How did you manage to mount the folder/copy the files? I run `mount -uw /` It seems to have worked, I saw that file dates changed after I copied my files, but when I restarted I saw the same old (10.15.6) files there in Sandbox.kext and sandboxd.

[dariusd]

Hi again everyone!

Just thought I should give you a heads-up: Fusion 11.5.6 does not include any solution or workaround for this memory leak issue when running on macOS 10.15.6 hosts.  Sorry to disappoint.

Thanks,

--

Darius

[rossco_au]

Thanks for the heads up.

Hopefully Apple fixes this soon - 2020 iMac users aren't going to have a downgrade option.

[dariusd]

Did you check that you had mounted your boot volume and were copying the files onto that (e.g. "/Volumes/Macintosh HD/System/Library/..."), not onto "/System/Library/..." (which would be the temporary Recovery environment)?  If you really remounted "/", it suggests you might have aimed for the wrong disk...

And you folks are more bold than I am with mixing-and-matching different kernel components.  Certainly not something I would endorse, but I admire the determination and the creative solution.  :smileycool:

--

Darius

[DanieDarko]

It's certainly nothing I would recommend, because it could lead to instability. But it's only a minor update, so kernel extensions should be compatible.

And what do I have to lose? Worst case scenario, I reinstall macOS

Once you mounted "Macintosh HD" using Disk Utility, you should run the terminal and simply enter

chroot /Volumes/Macintosh\ HD

This way you will use your actual macOS throughout the copy process. You may then run e.g.

rsync -r /Users/localUser/Desktop/macOS-10.15.5/System/Library/Extensions/Sandbox.kext /System/Library/Extensions/

rsync /Users/localUser/Desktop/macOS-10.15.5/usr/libexec/sandboxd /usr/libexec/

In my case I just had my VM crashing and after trying to run it again, it showed the known behaviour caused by the memory leak.

So replacing the kext alone doesn't seem to help. This time I replaced /usr/libexec/sandboxd as well and will test again.

EDIT:

Kernel memory is still leaking, so maybe it's caused by the kernel itself.

Don't know if i feel lucky enough to try to downgrade only the kernel, though  

[xfoo]

While I downgraded the entire macOS to 10.15.5, for those of you trying to make a frankenstein version with the 10.15.5 sandbox kext, this might be of interest: How Kernel Prelinking Works on macOS Catalina (or not)  Apparently macOS doesn't really load kexts from kext files, they are prelinked into a PrelinkedKernel. So if you are going to try to replace the kext file, you might also have to invoke some of these kextcache commands to regenerate a prelinked kernel.

[quasijones]

I usually get these symptoms:

- all apps start quitting

- no new apps will launch

- whatever process that's responsible for keeping me signed into google, icloud etc dies, resulting in popups prompting me to log into those services again

- popup "Unapproved caller - SecurityAgent may only be invoked by Apple software" and "Unrecoverable error - SecurityAgent was unable to create requested mechanism builtin:unlock-keychain" usually appears

- gentle reboot doesn't work- just grey screen/beachball for about 5 min until watchdog timeout KP's the whole thing

I've been seeing the exact symptoms above on a new Mac Mini every few days, I have to ssh in and reboot to recover.   The system does not have Fusion (or any other hypervisor) installed.

[ColoradoMarmot]

One thought Darius - do you folks have any contacts inside apple that you could push to have them repost the 10.15.5 installer to the update servers?  That has been a solid fix for the issue, but getting the installer from a reliable source is nigh on impossible.

[MJWaters1985]

For what it's worth, I upgraded to the Big Sur public beta last night and installed the Fusion Tech Preview, and haven't experienced this issue since.  Aside from a weird audio output issue over my Thunderbolt 3 -> HDMI adapter, I've not run into any issues with Big Sur, but YMMV.

[Ph33zy]

Thanks for posting and I was able to downgrade to 10.15.5.

Question:  Will this method allow me to downgrade back to Mojave 10.14.6 without wiping my system? 

[Kiriakos]

The certificates for pre-catalina installers expired as of February, so they are useless.  I could not downgrade to Mojave with my previously saved Mojave installer.  Luckily 10.15.5 is stable.

[petrisz]

This was probably not mentioned but here is what I do when I see that my mouse and screen freezes but otherwise some things are still running for a while:

• I SSH into my MacBook Pro from another machine. If you don't have other computer, there are SSH apps on iOS. It helps if you configure your DHCP server to reserve a certain IP address for your Mac. Most soho routers can be configured to assign a specific IP address to the MAC address of your Mac. Please know that you must configure your Mac in advance to accept incoming SSH connections.
• I try to suspend my VM. Maybe it's a futile attempt, but sometimes my VM is still running when I SSH into my Mac. Go to the directory of your VM and issue "vmrun suspend yourvirtualmachine.vmx"
• I always manage to SSH into my Mac in time in order to perform an "orderly shutdown" at least. There will be still programs that will not exit gracefully but get killed. However your daemons get stopped in a normal manner, your filesystem will be unmounted and you minimise the chance of data loss: "sudo shutdown -r now"

[NOMOS]

I downgraded to MacOS 15.5 using a Time Machine backup.  When the restore was complete, I could no longer even start VMware Fusion (11.5).  VMware Fusion crashes each time with "VMware Fusion quit unexpectedly".  The Apple crash log lists the Termination Reason as:

Termination Reason: Namespace CODESIGNING, Code 0x1

I can only find non-helpful reasons for that Termination.

So I restored (Time Machine again) back to 15.6 because I thought a functioning VMware Fusion with leaks is better than no VMware Fusion at all. 

But alas, after the restore, the same exact VMware crash still happens: Namespace CODESIGNING, Code 0x1

I've made sure the security settings are still correct (allowing VMware Full Disk Access), but nothing fixes this crash.

Any ideas?