wifi card BCM94360HMB no longer recognized by macos 12.1+

[Lorys89]

the wifi card that has the problem is this : BCM94360HMB (AW-CB160H) (14e4 43a0) mini pcie half size 1.3gbps

up to macos 12.0.1 it worked fine, trying to upgrade to 12.1 crashed in verbose.

by deactivating the wifi card from the bios, it is possible to update to 12.1 but then reactivating it does not start. using bootarg lilubetaall and not deactivating the card from the bios you can upgrade to 12.2 beta using lan cable, but the wifi card will not work even on 12.2 beta. the problem lies in the kext AirportBrcmFixup or plugin? I await your opinions.

[Core-i99]

Why lilubetaall? Lilu already supports Monterey pretty much a long time now

[Lorys89]

Why lilubetaall? Lilu already supports Monterey pretty much a long time now

it was one of the tests carried out.

[abenraj]

@Lorys89 Could you please try force-restarting your 12.1 installed system a few times, I'd suggest at least 10-15 counts just to be sure, and confirm if this boot kp is persistent? Make sure wifi module is on and also try without AirportBrcmFixup. Not a solution per se but could help provide some insights regarding AirportBrcmNIC PlugIn

[Lorys89]

@Lorys89 Could you please try force-restarting your 12.1 installed system a few times, I'd suggest at least 10-15 counts just to be sure, and confirm if this boot kp is persistent? Make sure wifi module is on and also try without AirportBrcmFixup. Not a solution per se but could help provide some insights regarding AirportBrcmNIC PlugIn

i already tried what you say, the kp always comes back. i could not find anything to fix it, just disabling the wifi card fixes the boot. and weird thing using lilubetaall starts but the card doesn't work.

[abenraj]

Alright, in that case the only other suggestion I'm able to help provide is to try tinker around with ASPM values, I'd suggest starting with value=0 and working your way up. Recommend to inject using help of AirportBrcmFixup along with boot-arg brcmfx-aspm=value. Good luck!

[Lorys89]

Alright, in that case the only other suggestion I'm able to help provide is to try tinker around with ASPM values, I'd suggest starting with value=0 and working your way up. Recommend to inject using help of AirportBrcmFixup along with boot-arg brcmfx-aspm=value. Good luck!

aspm is disabled by bios, never had aspm problems.

[Lorys89]

I update you with new developments, I managed to have wifi working using the kext DebugEnhancer, I had inserted it to log and starting I found that the wifi works, if I remove it the wifi stops working. removing the kext DebugEnhancer, I can start macos 12.2 beta 2 using bootargs -lilubetaall -brcmfxbeta, but the wifi doesn't work. i tried the bootarg -brcmfx-alldrv there is no change, if i try to boot without kext DebugEnhancer i get error in verbose and it doesn't start macos and the same if i don't put the 2 bootarg -lilubetaall -brcmfxbeta .

iMac not work wifi.ioreg.zip iMac wifi work good.ioreg.zip

[andreszerocross]

Can you upload your config.plist or EFI?? I need to check your configuration

[Lorys89]

Can you upload your config.plist or EFI?? I need to check your configuration

Dell Optiplex 9020 USFF EFI.zip

[dMatik02]

Same issue here, until 12.0.1 all worked flawlessly. Since 12.1 I get stuck in the same place, tried with aspm disabled in bios, tried with aspm enabled in bios and brcmfx-aspm=257 (with that value I get working ASPM in 12.0.1 without any issues), tried brcmfx-aspm=0, brcmfx-aspm 255, same, i get kp in same place. Will post my EFI bellow, ASUS X99 Deluxe (BCM94360HMB built in, pci14e4,43a0). Only way to boot is to disable the card in bios or spoof device id so AirPortBrcmNIC is not initialised.

Have to mention that in 12.0.1 even I can get ASPM working stable by enabling it in bios and using brcmfx-aspm=257. I can replicate same kernel panic in 12.0.1 by using brcmfx-aspm=258 (0x103) and get stuck in same place as now in 12.1 , so I thing Apple changed someting about ASPM in 12.1.

Tried same as above with 12.2b1, same behaviour.

Tried @Lorys89 solution, for me not working on 12.1.

KP without airportbrcmfixup

panic(cpu 2 caller 0xffffff801e7d5c53): Kernel trap at 0xffffff801e501082, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0xffffff954151b000, CR3: 0x0000000024a26000, CR4: 0x00000000001626e0
RAX: 0x0000000000583500, RBX: 0xffffff9541a9e000, RCX: 0x0000000000000300, RDX: 0x0000000000000800
RSP: 0xffffffd086e93888, RBP: 0xffffffd086e938a0, RSI: 0xffffff954151b000, RDI: 0xffffff9541a9e500
R8:  0x0000000000000004, R9:  0x0000000000000008, R10: 0x00000000ffffffff, R11: 0x00000000e0000000
R12: 0xffffff9541a9e000, R13: 0x0000000000000800, R14: 0xffffff954151ab00, R15: 0x0000000000000000
RFL: 0x0000000000010206, RIP: 0xffffff801e501082, CS:  0x0000000000000008, SS:  0x0000000000000000
Fault CR2: 0xffffff954151b000, Error code: 0x0000000000000000, Fault CPU: 0x2, PL: 0, VF: 10

Panicked task 0xffffff8ba868f670: 110 threads: pid 0: kernel_task
Backtrace (CPU 2), panicked thread: 0xffffff8ba87d1540, Frame : Return Address
0xffffffd086e932b0 : 0xffffff801e6860fd 
0xffffffd086e93300 : 0xffffff801e7e6095 
0xffffffd086e93340 : 0xffffff801e7d5863 
0xffffffd086e93390 : 0xffffff801e625a60 
0xffffffd086e933b0 : 0xffffff801e6864cd 
0xffffffd086e934d0 : 0xffffff801e685c86 
0xffffffd086e93530 : 0xffffff801ef16259 
0xffffffd086e935a0 : 0xffffff801e7d5c53 
0xffffffd086e93720 : 0xffffff801e7d5938 
0xffffffd086e93770 : 0xffffff801e625a60 
0xffffffd086e93790 : 0xffffff801e501082 
0xffffffd086e938a0 : 0xffffff802085e11e 
0xffffffd086e938f0 : 0xffffff802085d0f9 
0xffffffd086e939e0 : 0xffffff802083e1d3 
0xffffffd086e93a70 : 0xffffff802083d78c 
0xffffffd086e93ad0 : 0xffffff802066828c 
0xffffffd086e93b90 : 0xffffff802057c3b2 
0xffffffd086e93c60 : 0xffffff802057a938 
0xffffffd086e93cd0 : 0xffffff802057a4e1 
0xffffffd086e93d00 : 0xffffff801ee59ef0 
0xffffffd086e93d60 : 0xffffff802057b620 
0xffffffd086e93dd0 : 0xffffff801ee2e9fa 
0xffffffd086e93e30 : 0xffffff801ee2e565 
0xffffffd086e93ef0 : 0xffffff801ee2d560 
0xffffffd086e93f50 : 0xffffff801ee305c9 
0xffffffd086e93fa0 : 0xffffff801e62518e 
      Kernel Extensions in backtrace:
         com.apple.driver.AirPort.BrcmNIC(1400.1.1)[5836AF20-6464-3BF9-BD50-3312E2C73D90]@0xffffff802054f000->0xffffff8020aa9fff
            dependency: com.apple.driver.corecapture(1.0.4)[1A8E7B0A-B456-30AD-BD9F-7032D1A6E9DF]@0xffffff8021a23000->0xffffff8021a3cfff
            dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[C294EE9A-A5C7-39F7-8756-A8E66AED42CE]@0xffffff80211e0000->0xffffff80211e4fff
            dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[9E78AAB8-75A1-3070-87E4-C0A1B34ABEF4]@0xffffff80203ee000->0xffffff8020534fff
            dependency: com.apple.iokit.IONetworkingFamily(3.4)[8F50013F-1DAF-3503-8E71-6266FD3B3AD9]@0xffffff8020f4d000->0xffffff8020f63fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[F0A7BE4E-A81A-34BE-B032-EF7E61FB3C46]@0xffffff80211e7000->0xffffff8021211fff
            dependency: com.apple.iokit.IOSkywalkFamily(1.0)[D504070B-CF5A-36C4-8D49-7E9874EA6FA0]@0xffffff80212c6000->0xffffff802130dfff

Process name corresponding to current thread (0xffffff8ba87d1540): kernel_task
Boot args: npci=0x3000 alcid=7 -hbfx-disable-patch-pci root-dmg=file:///BaseSystem/BaseSystem.dmg chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
Not yet set

Kernel version:
Darwin Kernel Version 21.3.0: Wed Dec  8 00:40:29 PST 2021; root:xnu-8019.80.11.111.1~1/RELEASE_X86_64
Kernel UUID: BF33B3E6-D84E-3D04-845D-DBC6A1CF4E3D
KernelCache slide: 0x000000001e400000
KernelCache base:  0xffffff801e600000
Kernel slide:      0x000000001e410000
Kernel text base:  0xffffff801e610000
__HIB  text base: 0xffffff801e500000
System model name: iMacPro1,1 (Mac-7BA5B2D9E42DDD94)
System shutdown begun: NO
Panic diags file unavailable, panic occurred prior to initialization
Hibernation exit count: 0

System uptime in nanoseconds: 580859175
Last Sleep:           absolute           base_tsc          base_nano
  Uptime  : 0x00000000229f392c
  Sleep   : 0x0000000000000000 0x0000000000000000 0x0000000000000000
  Wake    : 0x0000000000000000 0x0000322198ed4f22 0x0000000000000000
Zone info:
Foreign   : 0xffffff8025d5b000 - 0xffffff8025d68000
Native    : 0xffffff80753ea000 - 0xffffffa0753ea000
Readonly  : 0xffffff85420b6000 - 0xffffff86dba4a000
Metadata  : 0xfffffffddf12f000 - 0xfffffffdff626000
Bitmaps   : 0xfffffffdff626000 - 0xfffffffe11626000

KP with airportbrcmfixup

panic(cpu 2 caller 0xffffff801e7d5c53): Kernel trap at 0xffffff801e501082, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0xffffff954151b000, CR3: 0x0000000024a26000, CR4: 0x00000000001626e0
RAX: 0x0000000000583500, RBX: 0xffffff9541a9e000, RCX: 0x0000000000000300, RDX: 0x0000000000000800
RSP: 0xffffffd086e93888, RBP: 0xffffffd086e938a0, RSI: 0xffffff954151b000, RDI: 0xffffff9541a9e500
R8:  0x0000000000000004, R9:  0x0000000000000008, R10: 0x00000000ffffffff, R11: 0x00000000e0000000
R12: 0xffffff9541a9e000, R13: 0x0000000000000800, R14: 0xffffff954151ab00, R15: 0x0000000000000000
RFL: 0x0000000000010206, RIP: 0xffffff801e501082, CS:  0x0000000000000008, SS:  0x0000000000000000
Fault CR2: 0xffffff954151b000, Error code: 0x0000000000000000, Fault CPU: 0x2, PL: 0, VF: 10

Panicked task 0xffffff8ba868f670: 110 threads: pid 0: kernel_task
Backtrace (CPU 2), panicked thread: 0xffffff8ba87d1540, Frame : Return Address
0xffffffd086e932b0 : 0xffffff801e6860fd 
0xffffffd086e93300 : 0xffffff801e7e6095 
0xffffffd086e93340 : 0xffffff801e7d5863 
0xffffffd086e93390 : 0xffffff801e625a60 
0xffffffd086e933b0 : 0xffffff801e6864cd 
0xffffffd086e934d0 : 0xffffff801e685c86 
0xffffffd086e93530 : 0xffffff801ef16259 
0xffffffd086e935a0 : 0xffffff801e7d5c53 
0xffffffd086e93720 : 0xffffff801e7d5938 
0xffffffd086e93770 : 0xffffff801e625a60 
0xffffffd086e93790 : 0xffffff801e501082 
0xffffffd086e938a0 : 0xffffff802085e11e 
0xffffffd086e938f0 : 0xffffff802085d0f9 
0xffffffd086e939e0 : 0xffffff802083e1d3 
0xffffffd086e93a70 : 0xffffff802083d78c 
0xffffffd086e93ad0 : 0xffffff802066828c 
0xffffffd086e93b90 : 0xffffff802057c3b2 
0xffffffd086e93c60 : 0xffffff802057a938 
0xffffffd086e93cd0 : 0xffffff802057a4e1 
0xffffffd086e93d00 : 0xffffff801ee59ef0 
0xffffffd086e93d60 : 0xffffff802057b620 
0xffffffd086e93dd0 : 0xffffff801ee2e9fa 
0xffffffd086e93e30 : 0xffffff801ee2e565 
0xffffffd086e93ef0 : 0xffffff801ee2d560 
0xffffffd086e93f50 : 0xffffff801ee305c9 
0xffffffd086e93fa0 : 0xffffff801e62518e 
      Kernel Extensions in backtrace:
         com.apple.driver.AirPort.BrcmNIC(1400.1.1)[5836AF20-6464-3BF9-BD50-3312E2C73D90]@0xffffff802054f000->0xffffff8020aa9fff
            dependency: com.apple.driver.corecapture(1.0.4)[1A8E7B0A-B456-30AD-BD9F-7032D1A6E9DF]@0xffffff8021a23000->0xffffff8021a3cfff
            dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[C294EE9A-A5C7-39F7-8756-A8E66AED42CE]@0xffffff80211e0000->0xffffff80211e4fff
            dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[9E78AAB8-75A1-3070-87E4-C0A1B34ABEF4]@0xffffff80203ee000->0xffffff8020534fff
            dependency: com.apple.iokit.IONetworkingFamily(3.4)[8F50013F-1DAF-3503-8E71-6266FD3B3AD9]@0xffffff8020f4d000->0xffffff8020f63fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[F0A7BE4E-A81A-34BE-B032-EF7E61FB3C46]@0xffffff80211e7000->0xffffff8021211fff
            dependency: com.apple.iokit.IOSkywalkFamily(1.0)[D504070B-CF5A-36C4-8D49-7E9874EA6FA0]@0xffffff80212c6000->0xffffff802130dfff

Process name corresponding to current thread (0xffffff8ba87d1540): kernel_task
Boot args: npci=0x3000 alcid=7 -hbfx-disable-patch-pci root-dmg=file:///BaseSystem/BaseSystem.dmg chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
Not yet set

Kernel version:
Darwin Kernel Version 21.3.0: Wed Dec  8 00:40:29 PST 2021; root:xnu-8019.80.11.111.1~1/RELEASE_X86_64
Kernel UUID: BF33B3E6-D84E-3D04-845D-DBC6A1CF4E3D
KernelCache slide: 0x000000001e400000
KernelCache base:  0xffffff801e600000
Kernel slide:      0x000000001e410000
Kernel text base:  0xffffff801e610000
__HIB  text base: 0xffffff801e500000
System model name: iMacPro1,1 (Mac-7BA5B2D9E42DDD94)
System shutdown begun: NO
Panic diags file unavailable, panic occurred prior to initialization
Hibernation exit count: 0

System uptime in nanoseconds: 580859175
Last Sleep:           absolute           base_tsc          base_nano
  Uptime  : 0x00000000229f392c
  Sleep   : 0x0000000000000000 0x0000000000000000 0x0000000000000000
  Wake    : 0x0000000000000000 0x0000322198ed4f22 0x0000000000000000
Zone info:
Foreign   : 0xffffff8025d5b000 - 0xffffff8025d68000
Native    : 0xffffff80753ea000 - 0xffffffa0753ea000
Readonly  : 0xffffff85420b6000 - 0xffffff86dba4a000
Metadata  : 0xfffffffddf12f000 - 0xfffffffdff626000
Bitmaps   : 0xfffffffdff626000 - 0xfffffffe11626000

EFI.zip imacpro.zip

[davidAlaBer]

I have the same card and the same issue. Sorry but not an expert in debugging. I use @Lorys89 efi and the same hardware.

[beelzebozox86]

ASUS z170-Deluxe has the same combo card. Can confirm that 12.1 won't boot unless Bluetooth and WIFI are disabled in BIOS with BrcmPatchRAM-2.6.1 BlueToothFixup.kext enabled.

[dMatik02]

@beelzebozox86 can you post your efi?

[dMatik02]

I can confirm as per @Lorys89 finding, DebugEnhancer.kext and -v boot argument is mandatory to boot BCM94360HMB on 12.1 if not we get this KP:

panic(cpu 10 caller 0xffffff801ffd78d3): Kernel trap at 0xffffff801fd01082, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0xffffff8bb85a5000, CR3: 0x0000000035d13000, CR4: 0x00000000001626e0
RAX: 0x00000000014c2500, RBX: 0xffffff8bb9a67000, RCX: 0x0000000000000300, RDX: 0x0000000000000800
RSP: 0xffffffd08f87b818, RBP: 0xffffffd08f87b830, RSI: 0xffffff8bb85a5000, RDI: 0xffffff8bb9a67500
R8:  0x0000000000000004, R9:  0x0000000000000008, R10: 0x00000000ffffffff, R11: 0x00000000e0000000
R12: 0xffffff8bb9a67000, R13: 0x0000000000000800, R14: 0xffffff8bb85a4b00, R15: 0x0000000000000000
RFL: 0x0000000000010206, RIP: 0xffffff801fd01082, CS:  0x0000000000000008, SS:  0x0000000000000010
Fault CR2: 0xffffff8bb85a5000, Error code: 0x0000000000000000, Fault CPU: 0xa, PL: 0, VF: 10

Panicked task 0xffffff9086498670: 128 threads: pid 0: kernel_task
Backtrace (CPU 10), panicked thread: 0xffffff86ecc02000, Frame : Return Address
0xffffffd08f87b240 : 0xffffff801fe87ddd mach_kernel : _handle_debugger_trap + 0x41d
0xffffffd08f87b290 : 0xffffff801ffe7d15 mach_kernel : _kdp_i386_trap + 0x145
0xffffffd08f87b2d0 : 0xffffff801ffd74e3 mach_kernel : _kernel_trap + 0x533
0xffffffd08f87b320 : 0xffffff801fe27a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd08f87b340 : 0xffffff801fe881ad mach_kernel : _DebuggerTrapWithState + 0xad
0xffffffd08f87b460 : 0xffffff801fe87966 mach_kernel : _panic_trap_to_debugger + 0x2b6
0xffffffd08f87b4c0 : 0xffffff80207160b9 mach_kernel : _panic + 0x54
0xffffffd08f87b530 : 0xffffff801ffd78d3 mach_kernel : _sync_iss_to_iks + 0x2c3
0xffffffd08f87b6b0 : 0xffffff801ffd75b8 mach_kernel : _kernel_trap + 0x608
0xffffffd08f87b700 : 0xffffff801fe27a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd08f87b720 : 0xffffff801fd01082 
0xffffffd08f87b830 : 0xffffff802205d11e com.apple.driver.AirPort.BrcmNIC : _otp_read_pci + 0xbd
0xffffffd08f87b880 : 0xffffff802205c0f9 com.apple.driver.AirPort.BrcmNIC : _initvars_srom_pci + 0x1bd
0xffffffd08f87b970 : 0xffffff802203d1d3 com.apple.driver.AirPort.BrcmNIC : _si_doattach + 0x9c1
0xffffffd08f87ba00 : 0xffffff802203c78c com.apple.driver.AirPort.BrcmNIC : _si_attach + 0x5c
0xffffffd08f87ba60 : 0xffffff8021e6728c com.apple.driver.AirPort.BrcmNIC : _wlc_attach + 0xaf
0xffffffd08f87bb20 : 0xffffff8021d7b3b2 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC8wlcStartEv + 0x198
0xffffffd08f87bbf0 : 0xffffff8021d79938 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10startGatedEP9IOService + 0x444
0xffffffd08f87bc60 : 0xffffff8021d794e1 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10_doCommandEP8OSObjectPvS2_S2_S2_ + 0x4b
0xffffffd08f87bc90 : 0xffffff802065a160 mach_kernel : __ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2_S2_ + 0xb0
0xffffffd08f87bcf0 : 0xffffff8021d7a620 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC5startEP9IOService + 0x3dc
0xffffffd08f87bd60 : 0xffffff8023e70f3c as.lvs1974.AirportBrcmFixup : __ZN6BRCMFX5startEP9IOServiceS1_ + 0x2dc
0xffffffd08f87bdd0 : 0xffffff802062ec2a mach_kernel : __ZN9IOService14startCandidateEPS_ + 0x11a
0xffffffd08f87be30 : 0xffffff802062e795 mach_kernel : __ZN9IOService15probeCandidatesEP12OSOrderedSet + 0xe75
0xffffffd08f87bef0 : 0xffffff802062d790 mach_kernel : __ZN9IOService14doServiceMatchEj + 0x3d0
0xffffffd08f87bf50 : 0xffffff8020630839 mach_kernel : __ZN15_IOConfigThread4mainEPvi + 0x189
0xffffffd08f87bfa0 : 0xffffff801fe2718e mach_kernel : _call_continuation + 0x2e
      Kernel Extensions in backtrace:
         as.lvs1974.AirportBrcmFixup(2.1.3)[C20D7792-FF2B-39ED-8E8B-8CEE49575869]@0xffffff8023e6d000->0xffffff8023e7ffff
            dependency: as.vit9696.Lilu(1.5.9)[B051298C-0FFC-32A7-B0D6-CB0DE0B793C0]@0xffffff8023da5000->0xffffff8023dcffff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[023CD3FF-4EFC-3455-89C2-FF8BD98013EB]@0xffffff80229e6000->0xffffff8022a10fff
         com.apple.driver.AirPort.BrcmNIC(1400.1.1)[8317BA9A-1DCA-3511-B6A6-422C6DB36026]@0xffffff8021d4e000->0xffffff80222a8fff
            dependency: com.apple.driver.corecapture(1.0.4)[71A27A2B-02AA-398B-9F77-1AC1C44EDF3D]@0xffffff8023223000->0xffffff802323cfff
            dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[BB22514A-F590-3FAE-B6FC-D7ABD4F7E1B9]@0xffffff80229df000->0xffffff80229e3fff
            dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[D73065D2-A7FE-35CE-A8C4-E0FBFFCCED6B]@0xffffff8021bed000->0xffffff8021d33fff
            dependency: com.apple.iokit.IONetworkingFamily(3.4)[39332FD1-54B0-3F6A-9FF1-2233888F6C5A]@0xffffff802274c000->0xffffff8022762fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[023CD3FF-4EFC-3455-89C2-FF8BD98013EB]@0xffffff80229e6000->0xffffff8022a10fff
            dependency: com.apple.iokit.IOSkywalkFamily(1.0)[1430AB44-3A66-32B0-B918-E3B0E71D5E83]@0xffffff8022ac5000->0xffffff8022b0cfff

Process name corresponding to current thread (0xffffff86ecc02000): kernel_task
Boot args: npci=0x3000 agdpmod=pikera keepsyms=1 debug=0x100 brcmfx-country=#a chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
21C52

Kernel version:
Darwin Kernel Version 21.2.0: Sun Nov 28 20:28:54 PST 2021; root:xnu-8019.61.5~1/RELEASE_X86_64
Kernel UUID: E32C293C-7D8B-327C-A335-6AAD250A4881
KernelCache slide: 0x000000001fc00000
KernelCache base:  0xffffff801fe00000
Kernel slide:      0x000000001fc10000
Kernel text base:  0xffffff801fe10000
__HIB  text base: 0xffffff801fd00000
System model name: A263,8201
System shutdown begun: NO
Panic diags file available: YES (0x0)
Hibernation exit count: 0

System uptime in nanoseconds: 4805020094
Last Sleep:           absolute           base_tsc          base_nano
  Uptime  : 0x000000011e66cdd5
  Sleep   : 0x0000000000000000 0x0000000000000000 0x0000000000000000
  Wake    : 0x0000000000000000 0x0000022434e9f538 0x0000000000000000
Zone info:
Foreign   : 0xffffff8037048000 - 0xffffff8037055000
Native    : 0xffffff8086318000 - 0xffffffa086318000
Readonly  : 0xffffff8552fe4000 - 0xffffff86ec978000
Metadata  : 0xffffffedf01c1000 - 0xffffffee106b4000
Bitmaps   : 0xffffffee106b4000 - 0xffffffee226b4000

As @Lorys89 said "DebugEnhancer.kext not work from recovery, work on os already installed", can you make debug enhancer.kext to be able to work from recovery to see if we can also boot 12.1 installer and 12.1 recovery.

[beelzebozox86]

@dMatik02 an you post your efi? EFI.zip Here you go.

[Andrey1970AppleLife]

CC @lvs1974

[Ur4ela]

Same problem with this card, doesn't work with 12.1 and 12.2 Monterey.

panic(cpu 2 caller 0xffffff802bdd5c53): Kernel trap at 0xffffff802bb01082, type 14=page fault, registers: CR0: 0x000000008001003b, CR2: 0xffffff99dade2000, CR3: 0x0000000035bca000, CR4: 0x00000000001626e0 RAX: 0xfffffff19a7f0d00, RBX: 0xffffff8b755d2800, RCX: 0x0000000000000300, RDX: 0x0000000000000800 RSP: 0xffffffd04cf83818, RBP: 0xffffffd04cf83830, RSI: 0xffffff99dade2000, RDI: 0xffffff8b755d2d00 R8: 0x0000000000000004, R9: 0x0000000000000002, R10: 0x00000000ffffffff, R11: 0x00000000f8000000 R12: 0xffffff8b755d2800, R13: 0x0000000000000800, R14: 0xffffff99dade1b00, R15: 0x0000000000000000 RFL: 0x0000000000010286, RIP: 0xffffff802bb01082, CS: 0x0000000000000008, SS: 0x0000000000000000 Fault CR2: 0xffffff99dade2000, Error code: 0x0000000000000000, Fault CPU: 0x2, PL: 0, VF: 10

Panicked task 0xffffff8b750d5670: 106 threads: pid 0: kernel_task Backtrace (CPU 2), panicked thread: 0xffffff950ebbb000, Frame : Return Address 0xffffffd04cf83240 : 0xffffff802bc860fd mach_kernel : _handle_debugger_trap + 0x41d 0xffffffd04cf83290 : 0xffffff802bde6095 mach_kernel : _kdp_i386_trap + 0x145 0xffffffd04cf832d0 : 0xffffff802bdd5863 mach_kernel : _kernel_trap + 0x533 0xffffffd04cf83320 : 0xffffff802bc25a60 mach_kernel : _return_from_trap + 0xe0 0xffffffd04cf83340 : 0xffffff802bc864cd mach_kernel : _DebuggerTrapWithState + 0xad 0xffffffd04cf83460 : 0xffffff802bc85c86 mach_kernel : _panic_trap_to_debugger + 0x2b6 0xffffffd04cf834c0 : 0xffffff802c516259 mach_kernel : _panic + 0x54 0xffffffd04cf83530 : 0xffffff802bdd5c53 mach_kernel : _sync_iss_to_iks + 0x2c3 0xffffffd04cf836b0 : 0xffffff802bdd5938 mach_kernel : _kernel_trap + 0x608 0xffffffd04cf83700 : 0xffffff802bc25a60 mach_kernel : _return_from_trap + 0xe0 0xffffffd04cf83720 : 0xffffff802bb01082 0xffffffd04cf83830 : 0xffffff802de5e11e com.apple.driver.AirPort.BrcmNIC : _otp_read_pci + 0xbd 0xffffffd04cf83880 : 0xffffff802de5d0f9 com.apple.driver.AirPort.BrcmNIC : _initvars_srom_pci + 0x1bd 0xffffffd04cf83970 : 0xffffff802de3e1d3 com.apple.driver.AirPort.BrcmNIC : _si_doattach + 0x9c1 0xffffffd04cf83a00 : 0xffffff802de3d78c com.apple.driver.AirPort.BrcmNIC : _si_attach + 0x5c 0xffffffd04cf83a60 : 0xffffff802dc6828c com.apple.driver.AirPort.BrcmNIC : _wlc_attach + 0xaf 0xffffffd04cf83b20 : 0xffffff802db7c3b2 com.apple.driver.AirPort.BrcmNIC : ZN15AirPort_BrcmNIC8wlcStartEv + 0x198 0xffffffd04cf83bf0 : 0xffffff802db7a938 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10startGatedEP9IOService + 0x444 0xffffffd04cf83c60 : 0xffffff802db7a4e1 com.apple.driver.AirPort.BrcmNIC : ZN15AirPort_BrcmNIC10_doCommandEP8OSObjectPvS2_S2S2 + 0x4b 0xffffffd04cf83c90 : 0xffffff802c459ef0 mach_kernel : ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2S2 + 0xb0 0xffffffd04cf83cf0 : 0xffffff802db7b620 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC5startEP9IOService + 0x3dc 0xffffffd04cf83d60 : 0xffffff802fbd6f3c as.lvs1974.AirportBrcmFixup : ZN6BRCMFX5startEP9IOServiceS1_ + 0x2dc 0xffffffd04cf83dd0 : 0xffffff802c42e9fa mach_kernel : ZN9IOService14startCandidateEPS_ + 0x11a 0xffffffd04cf83e30 : 0xffffff802c42e565 mach_kernel : ZN9IOService15probeCandidatesEP12OSOrderedSet + 0xe75 0xffffffd04cf83ef0 : 0xffffff802c42d560 mach_kernel : __ZN9IOService14doServiceMatchEj + 0x3d0 0xffffffd04cf83f50 : 0xffffff802c4305c9 mach_kernel : __ZN15_IOConfigThread4mainEPvi + 0x189 0xffffffd04cf83fa0 : 0xffffff802bc2518e mach_kernel : _call_continuation + 0x2e Kernel Extensions in backtrace: as.lvs1974.AirportBrcmFixup(2.1.3)[C20D7792-FF2B-39ED-8E8B-8CEE49575869]com.apple.0xffffff802fbd3000-com.apple.driver.0xffffff802fbe5fff dependency: as.vit9696.Lilu(1.5.9)[B051298C-0FFC-32A7-B0D6-CB0DE0B793C0]com.apple.0xffffff802fba5000-com.apple.driver.0xffffff802fbcffff dependency: com.apple.iokit.IOPCIFamily(2.9)[F0A7BE4E-A81A-34BE-B032-EF7E61FB3C46]com.apple.0xffffff802e7e7000-com.apple.driver.0xffffff802e811fff com.apple.driver.AirPort.BrcmNIC(1400.1.1)[5836AF20-6464-3BF9-BD50-3312E2C73D90]com.apple.0xffffff802db4f000-com.apple.driver.0xffffff802e0a9fff dependency: com.apple.driver.corecapture(1.0.4)[1A8E7B0A-B456-30AD-BD9F-7032D1A6E9DF]com.apple.0xffffff802f023000-com.apple.driver.0xffffff802f03cfff dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[C294EE9A-A5C7-39F7-8756-A8E66AED42CE]com.apple.0xffffff802e7e0000-com.apple.driver.0xffffff802e7e4fff dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[9E78AAB8-75A1-3070-87E4-C0A1B34ABEF4]com.apple.0xffffff802d9ee000-com.apple.driver.0xffffff802db34fff dependency: com.apple.iokit.IONetworkingFamily(3.4)[8F50013F-1DAF-3503-8E71-6266FD3B3AD9]com.apple.0xffffff802e54d000-com.apple.driver.0xffffff802e563fff dependency: com.apple.iokit.IOPCIFamily(2.9)[F0A7BE4E-A81A-34BE-B032-EF7E61FB3C46]com.apple.0xffffff802e7e7000-com.apple.driver.0xffffff802e811fff dependency: com.apple.iokit.IOSkywalkFamily(1.0)[D504070B-CF5A-36C4-8D49-7E9874EA6FA0]com.apple.0xffffff802e8c6000-com.apple.driver.0xffffff802e90dfff

Process name corresponding to current thread (0xffffff950ebbb000): kernel_task Boot args: -v -brcmfxdbg keepsyms=1 msgbuf=1048576 debag=0x100 root-dmg=file:///BaseSystem/BaseSystem.dmg

Mac OS version: Not yet set

Kernel version: Darwin Kernel Version 21.3.0: Wed Dec 8 00:40:29 PST 2021; root:xnu-8019.80.11.111.1~1/RELEASE_X86_64 Kernel UUID: BF33B3E6-D84E-3D04-845D-DBC6A1CF4E3D KernelCache slide: 0x000000002ba00000 KernelCache base: 0xffffff802bc00000 Kernel slide: 0x000000002ba10000 Kernel text base: 0xffffff802bc10000 __HIB text base: 0xffffff802bb00000 System model name: MacBookAir7,1 (Mac-9F18E312C5C2BF0B) System shutdown begun: NO Panic diags file unavailable, panic occurred prior to initialization Hibernation exit count: 0

System uptime in nanoseconds: 4978196077 Last Sleep: absolute base_tsc base_nano Uptime : 0x000000012a5ad237 Sleep : 0x0000000000000000 0x0000000000000000 0x0000000000000000 Wake : 0x0000000000000000 0x0000001115dc4c30 0x0000000000000000 Zone info: Foreign : 0xffffff8035fe3000 - 0xffffff8035ff0000 Native : 0xffffff8041e5a000 - 0xffffffa041e5a000 Readonly : 0xffffff850eb26000 - 0xffffff86a84ba000 Metadata : 0xffffffed12e37000 - 0xffffffed32ef6000 Bitmaps : 0xffffffed32ef6000 - 0xffffffed35ef6000 last started kext at 2751693452: as.acidanthera.BrcmPatchRAM3 2.6.2 (addr 0xffffff80301de000, size 53248) loaded kexts: as.acidanthera.BrcmPatchRAM3 2.6.2 com.insanelymac.RealtekRTL8111 2.4.2 com.sinet3k.Sinetek-rtsx 4 org.emlydinesh.driver.ApplePS2SmartTouchPad 4.6.8 org.emlydinesh.driver.ApplePS2Keyboard 4.6.8 org.emlydinesh.driver.ApplePS2Controller 4.6.8 as.vit9696.RestrictEvents 1.0.5 as.acidanthera.BrcmFirmwareStore 2.6.2 as.acidanthera.BlueToolFixup 2.6.2 ru.usrsse2.SMCBatteryManager 1.2.8 as.vit9696.VirtualSMC 1.2.8 org.vanilla.driver.CPUFriend 1.2.5 as.vit9696.AppleALC 1.6.8 as.vit9696.WhateverGreen 1.5.6 as.lvs1974.AirportBrcmFixup 2.1.3 as.vit9696.Lilu 1.5.9 com.apple.iokit.SCSITaskUserClient 452.60.2 com.apple.driver.AppleFileSystemDriver 3.0.1 com.apple.filesystems.tmpfs 1 com.apple.filesystems.lifs 1 com.apple.filesystems.hfs.kext 582.60.2 com.apple.BootCache 40 com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0 com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1 com.apple.driver.AppleSmartBatteryManager 161.0.0 com.apple.filesystems.apfs 1933.61.1 com.apple.private.KextAudit 1.0 com.apple.driver.AppleAHCIPort 351 com.apple.driver.AirPort.BrcmNIC 1400.1.1 com.apple.driver.AppleIntelCPUPowerManagementClient 222.0.0 com.apple.driver.AppleRTC 2.0.1 com.apple.driver.AppleACPIButtons 6.1 com.apple.driver.AppleHPET 1.8 com.apple.driver.AppleSMBIOS 2.1 com.apple.driver.AppleACPIEC 6.1 com.apple.driver.AppleAPIC 1.7 com.apple.AppleSystemPolicy 2.0.0 com.apple.nke.applicationfirewall 402 com.apple.iokit.IOKitRegistryCompatibility 1 com.apple.iokit.EndpointSecurity 1 com.apple.Dont_Steal_Mac_OS_X 7.0.0 com.apple.driver.AppleIntelCPUPowerManagement 222.0.0 com.apple.kec.AppleEncryptedArchive 1 com.apple.driver.usb.cdc 5.0.0 com.apple.driver.usb.networking 5.0.0 com.apple.driver.usb.AppleUSBHostCompositeDevice 1.2 com.apple.driver.usb.AppleUSBHub 1.2 com.apple.iokit.IOSCSIMultimediaCommandsDevice 452.60.2 com.apple.iokit.IOBDStorageFamily 1.8 com.apple.iokit.IODVDStorageFamily 1.8 com.apple.iokit.IOCDStorageFamily 1.8 com.apple.driver.AppleUSBMergeNub 900.4.2 com.apple.driver.AppleBSDKextStarter 3 com.apple.iokit.IOSurface 302.11.1 com.apple.filesystems.hfs.encodings.kext 1 com.apple.driver.usb.AppleUSBHostPacketFilter 1.0 com.apple.iokit.IOUSBFamily 900.4.2 com.apple.driver.AppleXsanScheme 3 com.apple.iokit.IOAHCISerialATAPI 268 com.apple.iokit.IOAHCIBlockStorage 333 com.apple.iokit.IOAHCIFamily 295 com.apple.iokit.IO80211FamilyLegacy 1200.12.2b1 com.apple.iokit.IOSkywalkFamily 1.0 com.apple.driver.mDNSOffloadUserClient 1.0.1b8 com.apple.driver.corecapture 1.0.4 com.apple.driver.usb.AppleUSBXHCIPCI 1.2 com.apple.driver.usb.AppleUSBXHCI 1.2 com.apple.driver.usb.AppleUSBEHCIPCI 1.2 com.apple.driver.usb.AppleUSBEHCI 1.2 com.apple.driver.AppleEFINVRAM 2.1 com.apple.driver.AppleEFIRuntime 2.1 com.apple.iokit.IOHIDFamily 2.0.0 com.apple.iokit.IOSMBusFamily 1.1 com.apple.iokit.IOTimeSyncFamily 1000.11 com.apple.iokit.IONetworkingFamily 3.4 com.apple.driver.DiskImages 493.0.0 com.apple.iokit.IOBluetoothFamily 9.0.0 com.apple.iokit.IOReportFamily 47 com.apple.security.quarantine 4 com.apple.security.sandbox 300.0 com.apple.kext.AppleMatch 1.0.0d1 com.apple.iokit.CoreAnalyticsFamily 1 com.apple.driver.AppleSSE 1.0 com.apple.driver.AppleKeyStore 2 com.apple.driver.AppleUSBTDM 532.40.7 com.apple.iokit.IOUSBMassStorageDriver 209.40.6 com.apple.iokit.IOSCSIBlockCommandsDevice 452.60.2 com.apple.iokit.IOStorageFamily 2.1 com.apple.iokit.IOSCSIArchitectureModelFamily 452.60.2 com.apple.driver.AppleMobileFileIntegrity 1.0.5 com.apple.security.AppleImage4 4.2.0 com.apple.kext.CoreTrust 1 com.apple.driver.AppleFDEKeyStore 28.30 com.apple.driver.AppleEffaceableStorage 1.0 com.apple.driver.AppleCredentialManager 1.0 com.apple.driver.KernelRelayHost 1 com.apple.iokit.IOUSBHostFamily 1.2 com.apple.driver.AppleUSBHostMergeProperties 1.2 com.apple.driver.usb.AppleUSBCommon 1.0 com.apple.driver.AppleBusPowerController 1.0 com.apple.driver.AppleSEPManager 1.0.1 com.apple.driver.IOSlaveProcessor 1 com.apple.driver.AppleACPIPlatform 6.1 com.apple.driver.AppleSMC 3.1.9 com.apple.iokit.IOPCIFamily 2.9 com.apple.iokit.IOACPIFamily 1.4 com.apple.driver.watchdog 1 com.apple.kec.pthread 1 com.apple.ke

[lvs1974]

DebugEnhancer adds nothing except boot delay (because of extensive logging). Please try attached kext with a delay (and there is no country-code fix). AirportBrcmFixup-2.1.4-DEBUG.zip

[dMatik02]

Works without debug enhancer & -v bootarg: 12.1, 12.1 Installer, 12.1 Recovery, 12.2 Recovery Not Working: 12.2 Installer, 12.2

KP 12.2 : Installer&Installed

panic(cpu 4 caller 0xffffff801ebd5c53): Kernel trap at 0xffffff801e901082, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0xffffff8bb8df0000, CR3: 0x0000000034bc1000, CR4: 0x00000000001626e0
RAX: 0x00000009993cbd00, RBX: 0xffffff95521bb800, RCX: 0x0000000000000300, RDX: 0x0000000000000800
RSP: 0xffffffd08e76b818, RBP: 0xffffffd08e76b830, RSI: 0xffffff8bb8df0000, RDI: 0xffffff95521bbd00
R8:  0x0000000000000004, R9:  0x0000000000000008, R10: 0x00000000ffffffff, R11: 0x00000000e0000000
R12: 0xffffff95521bb800, R13: 0x0000000000000800, R14: 0xffffff8bb8defb00, R15: 0x0000000000000000
RFL: 0x0000000000010206, RIP: 0xffffff801e901082, CS:  0x0000000000000008, SS:  0x0000000000000000
Fault CR2: 0xffffff8bb8df0000, Error code: 0x0000000000000000, Fault CPU: 0x4, PL: 0, VF: 10

Panicked task 0xffffff9551bf0670: 129 threads: pid 0: kernel_task
Backtrace (CPU 4), panicked thread: 0xffffff9084bdcaa0, Frame : Return Address
0xffffffd08e76b240 : 0xffffff801ea860fd mach_kernel : _handle_debugger_trap + 0x41d
0xffffffd08e76b290 : 0xffffff801ebe6095 mach_kernel : _kdp_i386_trap + 0x145
0xffffffd08e76b2d0 : 0xffffff801ebd5863 mach_kernel : _kernel_trap + 0x533
0xffffffd08e76b320 : 0xffffff801ea25a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd08e76b340 : 0xffffff801ea864cd mach_kernel : _DebuggerTrapWithState + 0xad
0xffffffd08e76b460 : 0xffffff801ea85c86 mach_kernel : _panic_trap_to_debugger + 0x2b6
0xffffffd08e76b4c0 : 0xffffff801f316259 mach_kernel : _panic + 0x54
0xffffffd08e76b530 : 0xffffff801ebd5c53 mach_kernel : _sync_iss_to_iks + 0x2c3
0xffffffd08e76b6b0 : 0xffffff801ebd5938 mach_kernel : _kernel_trap + 0x608
0xffffffd08e76b700 : 0xffffff801ea25a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd08e76b720 : 0xffffff801e901082 
0xffffffd08e76b830 : 0xffffff8020c5e11e com.apple.driver.AirPort.BrcmNIC : _otp_read_pci + 0xbd
0xffffffd08e76b880 : 0xffffff8020c5d0f9 com.apple.driver.AirPort.BrcmNIC : _initvars_srom_pci + 0x1bd
0xffffffd08e76b970 : 0xffffff8020c3e1d3 com.apple.driver.AirPort.BrcmNIC : _si_doattach + 0x9c1
0xffffffd08e76ba00 : 0xffffff8020c3d78c com.apple.driver.AirPort.BrcmNIC : _si_attach + 0x5c
0xffffffd08e76ba60 : 0xffffff8020a6828c com.apple.driver.AirPort.BrcmNIC : _wlc_attach + 0xaf
0xffffffd08e76bb20 : 0xffffff802097c3b2 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC8wlcStartEv + 0x198
0xffffffd08e76bbf0 : 0xffffff802097a938 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10startGatedEP9IOService + 0x444
0xffffffd08e76bc60 : 0xffffff802097a4e1 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10_doCommandEP8OSObjectPvS2_S2_S2_ + 0x4b
0xffffffd08e76bc90 : 0xffffff801f259ef0 mach_kernel : __ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2_S2_ + 0xb0
0xffffffd08e76bcf0 : 0xffffff802097b620 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC5startEP9IOService + 0x3dc
0xffffffd08e76bd60 : 0xffffff8022a4d089 as.lvs1974.AirportBrcmFixup : __ZN6BRCMFX5startEP9IOServiceS1_ + 0x269
0xffffffd08e76bdd0 : 0xffffff801f22e9fa mach_kernel : __ZN9IOService14startCandidateEPS_ + 0x11a
0xffffffd08e76be30 : 0xffffff801f22e565 mach_kernel : __ZN9IOService15probeCandidatesEP12OSOrderedSet + 0xe75
0xffffffd08e76bef0 : 0xffffff801f22d560 mach_kernel : __ZN9IOService14doServiceMatchEj + 0x3d0
0xffffffd08e76bf50 : 0xffffff801f2305c9 mach_kernel : __ZN15_IOConfigThread4mainEPvi + 0x189
0xffffffd08e76bfa0 : 0xffffff801ea2518e mach_kernel : _call_continuation + 0x2e
      Kernel Extensions in backtrace:
         as.lvs1974.AirportBrcmFixup(2.1.4)[46640E57-6156-37A6-8596-D8DEABEAE35F]@0xffffff8022a49000->0xffffff8022a5bfff
            dependency: as.vit9696.Lilu(1.5.9)[8561D0E0-E51D-3555-A780-915710EEEEE4]@0xffffff80229a5000->0xffffff8022a2cfff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[F0A7BE4E-A81A-34BE-B032-EF7E61FB3C46]@0xffffff80215e7000->0xffffff8021611fff
         com.apple.driver.AirPort.BrcmNIC(1400.1.1)[5836AF20-6464-3BF9-BD50-3312E2C73D90]@0xffffff802094f000->0xffffff8020ea9fff
            dependency: com.apple.driver.corecapture(1.0.4)[1A8E7B0A-B456-30AD-BD9F-7032D1A6E9DF]@0xffffff8021e23000->0xffffff8021e3cfff
            dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[C294EE9A-A5C7-39F7-8756-A8E66AED42CE]@0xffffff80215e0000->0xffffff80215e4fff
            dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[9E78AAB8-75A1-3070-87E4-C0A1B34ABEF4]@0xffffff80207ee000->0xffffff8020934fff
            dependency: com.apple.iokit.IONetworkingFamily(3.4)[8F50013F-1DAF-3503-8E71-6266FD3B3AD9]@0xffffff802134d000->0xffffff8021363fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[F0A7BE4E-A81A-34BE-B032-EF7E61FB3C46]@0xffffff80215e7000->0xffffff8021611fff
            dependency: com.apple.iokit.IOSkywalkFamily(1.0)[D504070B-CF5A-36C4-8D49-7E9874EA6FA0]@0xffffff80216c6000->0xffffff802170dfff

Process name corresponding to current thread (0xffffff9084bdcaa0): kernel_task
Boot args: npci=0x3000 keepsyms=1 alcid=7 -brcmfxdbg -liludbgall -bsdmgroot chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
Not yet set

Kernel version:
Darwin Kernel Version 21.3.0: Wed Dec  8 00:40:29 PST 2021; root:xnu-8019.80.11.111.1~1/RELEASE_X86_64
Kernel UUID: BF33B3E6-D84E-3D04-845D-DBC6A1CF4E3D
KernelCache slide: 0x000000001e800000
KernelCache base:  0xffffff801ea00000
Kernel slide:      0x000000001e810000
Kernel text base:  0xffffff801ea10000
__HIB  text base: 0xffffff801e900000
System model name: iMacPro1,1 (Mac-7BA5B2D9E42DDD94)
System shutdown begun: NO
Panic diags file unavailable, panic occurred prior to initialization
Hibernation exit count: 0

System uptime in nanoseconds: 4285880509
Last Sleep:           absolute           base_tsc          base_nano
  Uptime  : 0x00000000ff755d3d
  Sleep   : 0x0000000000000000 0x0000000000000000 0x0000000000000000
  Wake    : 0x0000000000000000 0x000000ffbb12dff1 0x0000000000000000
Zone info:
Foreign   : 0xffffff8035ef6000 - 0xffffff8035f03000
Native    : 0xffffff8085133000 - 0xffffffa085133000
Readonly  : 0xffffff8551dff000 - 0xffffff86eb793000
Metadata  : 0xfffffff7daf19000 - 0xfffffff7fb40c000
Bitmaps   : 0xfffffff7fb40c000 - 0xfffffff80d40c000

EFI.zip

[Lorys89]

DebugEnhancer adds nothing except boot delay (because of extensive logging). Please try attached kext with a delay (and there is no country-code fix). AirportBrcmFixup-2.1.4-DEBUG.zip

first of all thanks for your effort, I tried the kext without using DebugEnhancer, and start os 12.2 b2 already installed, does not start revovery nor installation, and obviously does not work the fix country #a

in the previous method with DebugEnhancer worked the fix country #a

[lvs1974]

@Lorys89 : you are welcome. Could you try another attached version - it has all patches, only delays are increased, and ASPM=0 by default (if it is not overridden in boot-args or dev properties). AirportBrcmFixup-2.1.4-DEBUG.zip

[dMatik02]

@lvs1974 even this has here same behaviour, work: 12.1 (installer, installed, recovery), 12.2 recovery. Not working :12.2 (installer, installed)

After some log comparing to 12.0.1 (where this particular card works even without AirportBrcmFixup), i can see that the kernel panic occurs when mac os (12.1+) tries to initialize the card.

12.0.1

(IOPCIFamily) <IOPCIFamily`IOPCIConfigurator::configure(unsigned int)> [ PCI configuration end, bridges 1, devices 56 ]

(IOPCIFamily) <IOPCIFamily`IOPCIConfigurator::configure(unsigned int)> [ PCI configuration begin ]

kPEDisableScreen 1

initialize_screen: b=C0000000, w=00000D70, h=000005A0, r=00003600, d=00000001

kPEEnableScreen 1

(IOPCIFamily) <IOPCIFamily`IOPCIConfigurator::configure(unsigned int)> console relocated to 0xc0000000

(IOPCIFamily) <IOPCIFamily`IOPCIConfigurator::configure(unsigned int)> [ PCI configuration end, bridges 12, devices 73 ]

(IOAHCIFamily) <IOAHCIFamily`IOAHCIPortMultiplierGlobals::IOAHCIPortMultiplierGlobals()> [AHCI][PML][00000000]+IOAHCIPortMultiplierGlobals::IOAHCIPortMultiplierGlobals

(IOAHCIFamily) <IOAHCIFamily`IOAHCIPortMultiplierGlobals::IOAHCIPortMultiplierGlobals()> [AHCI][PML][00000000]-IOAHCIPortMultiplierGlobals::IOAHCIPortMultiplierGlobals

(IO80211FamilyLegacy) <IO80211FamilyLegacy`IO80211Controller::init(OSDictionary*)> AirPort_BrcmNIC::init IO80211Legacy_kexts-25.6 "IO80211Legacy_kexts-25.6" Oct 14 2021 00:38:10

(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 4.307652: AirPort_Brcm43XX:probe:, this[0xc424de1761563e3f]  score[1400]

12.1

(IOPCIFamily) <IOPCIFamily`IOPCIConfigurator::configure(unsigned int)> [ PCI configuration end, bridges 1, devices 56 ]

IOPCIFamily) <IOPCIFamily`IOPCIConfigurator::configure(unsigned int)> [ PCI configuration begin ]

kPEDisableScreen 1

initialize_screen: b=C0000000, w=00000D70, h=000005A0, r=00003600, d=00000001

kPEEnableScreen 1

(IOPCIFamily) <IOPCIFamily`IOPCIConfigurator::configure(unsigned int)> console relocated to 0xc0000000

(IOPCIFamily) <IOPCIFamily`IOPCIConfigurator::configure(unsigned int)> [ PCI configuration end, bridges 12, devices 73 ]

(IOAHCIFamily) <IOAHCIFamily`IOAHCIPortMultiplierGlobals::IOAHCIPortMultiplierGlobals()> [AHCI][PML][00000000]+IOAHCIPortMultiplierGlobals::IOAHCIPortMultiplierGlobals

(IOAHCIFamily) <IOAHCIFamily`IOAHCIPortMultiplierGlobals::IOAHCIPortMultiplierGlobals()> [AHCI][PML][00000000]-IOAHCIPortMultiplierGlobals::IOAHCIPortMultiplierGlobals

(IO80211FamilyLegacy) <IO80211FamilyLegacy`IO80211Controller::init(OSDictionary*)> AirPort_BrcmNIC::init IO80211Legacy_kexts-30.1 "IO80211Legacy_kexts-30.1" Nov 30 2021 21:31:36

2022-01-24 00:48:41.199609+0200  localhost kernel[0]: (AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 2.199608: AirPort_Brcm43XX:probe:, this[0xd513a1a21ce6c57]  score[1400]

The kp (12.1 without time delay) occurs here:

(IO80211FamilyLegacy) <IO80211FamilyLegacy IO80211Controller::init(OSDictionary*)> AirPort_BrcmNIC::init IO80211Legacy_kexts-30.1 "IO80211Legacy_kexts-30.1" Nov 30 2021 21:31:36

It seems that at least for me adding time delay to "AirportBrcmFixup-2.1.4-DEBUG" made a difference and I can boot 12.1.

I think there were some changes made between "IO80211Legacy_kexts-25.6" (12.0.1) and "IO80211Legacy_kexts-30.1" (12.1+) witch somehow fail to init this cards.

I don't think this is releated to us but I leave it here > https://gitmemory.cn/repo/OpenIntelWireless/itlwm/issues/738 <

[lvs1974]

Hello everybody! AirportBrcmFixup-2.1.4-DEBUG_7.zip Could you test attached version in recovery/installer/regular boot please? And would be great if you could test it in Big Sur also!

Thank you for testing!

[lvs1974]

And one more version for testing (try to fix panic in installer): AirportBrcmFixup-2.1.4-DEBUG_8.zip

[abenraj]

@lvs1974 Massive thank you for your time and effort!

Can confirm, the last attached version finally fixes the intermittent boot-kp issue which is also present with legacy card DW1820a 14e4:43a3 since 12.0 b4+. On 12.2 (21D48) the loading bar now moves farther than before (this does potentially look like the delay workaround is indeed helpful here with the successful driver init) but again, another similar KP is still lurking, now at a later stage, which to be noted, is once again intermittent, not persistent, similar to the initial boot-kp scenario, which seems to have been fixed with the delay. Not sure if AirportBrcmNIC is causing the same kp, now later than boot init?

panic(cpu 1 caller 0xffffff80187d5bf3): Kernel trap at 0xffffff8018501082, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0xffffff99daaee000, CR3: 0x000000002e82a000, CR4: 0x00000000003626e0
RAX: 0x0000000000055500, RBX: 0xffffff99dab43000, RCX: 0x0000000000000300, RDX: 0x0000000000000800
RSP: 0xffffffd04fefb7d8, RBP: 0xffffffd04fefb7f0, RSI: 0xffffff99daaee000, RDI: 0xffffff99dab43500
R8:  0x0000000000000004, R9:  0x0000000000000001, R10: 0x00000000ffffffff, R11: 0x00000000e0000000
R12: 0xffffff99dab43000, R13: 0x0000000000000800, R14: 0xffffff99daaedb00, R15: 0x0000000000000000
RFL: 0x0000000000010206, RIP: 0xffffff8018501082, CS:  0x0000000000000008, SS:  0x0000000000000000
Fault CR2: 0xffffff99daaee000, Error code: 0x0000000000000000, Fault CPU: 0x1, PL: 0, VF: 10

Panicked task 0xffffff99db061670: 119 threads: pid 0: kernel_task
Backtrace (CPU 1), panicked thread: 0xffffff90419e8000, Frame : Return Address
0xffffffd04fefb200 : 0xffffff8018685ffd 
0xffffffd04fefb250 : 0xffffff80187e6035 
0xffffffd04fefb290 : 0xffffff80187d5803 
0xffffffd04fefb2e0 : 0xffffff8018625a60 
0xffffffd04fefb300 : 0xffffff80186863cd 
0xffffffd04fefb420 : 0xffffff8018685b86 
0xffffffd04fefb480 : 0xffffff8018f16409 
0xffffffd04fefb4f0 : 0xffffff80187d5bf3 
0xffffffd04fefb670 : 0xffffff80187d58d8 
0xffffffd04fefb6c0 : 0xffffff8018625a60 
0xffffffd04fefb6e0 : 0xffffff8018501082 
0xffffffd04fefb7f0 : 0xffffff801a85e11e 
0xffffffd04fefb840 : 0xffffff801c950952 
0xffffffd04fefb880 : 0xffffff801a85d0f9 
0xffffffd04fefb970 : 0xffffff801a83e1d3 
0xffffffd04fefba00 : 0xffffff801a83d78c 
0xffffffd04fefba60 : 0xffffff801a66828c 
0xffffffd04fefbb20 : 0xffffff801a57c3b2 
0xffffffd04fefbbf0 : 0xffffff801a57a938 
0xffffffd04fefbc60 : 0xffffff801a57a4e1 
0xffffffd04fefbc90 : 0xffffff8018e5a0a0 
0xffffffd04fefbcf0 : 0xffffff801a57b620 
0xffffffd04fefbd60 : 0xffffff801c94ecb9 
0xffffffd04fefbdd0 : 0xffffff8018e2ebaa 
0xffffffd04fefbe30 : 0xffffff8018e2e715 
0xffffffd04fefbef0 : 0xffffff8018e2d710 
0xffffffd04fefbf50 : 0xffffff8018e30779 
0xffffffd04fefbfa0 : 0xffffff801862518e 
      Kernel Extensions in backtrace:
         as.lvs1974.AirportBrcmFixup(2.1.4)[D72C0F46-3F9C-3339-93E5-747ECF8B6C28]@0xffffff801c94b000->0xffffff801c95efff
            dependency: as.vit9696.Lilu(1.5.9)[B051298C-0FFC-32A7-B0D6-CB0DE0B793C0]@0xffffff801c5a9000->0xffffff801c5d3fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[897B72E0-B98F-30BA-8CB2-4E5E469CE4B6]@0xffffff801b1e7000->0xffffff801b211fff
         com.apple.driver.AirPort.BrcmNIC(1400.1.1)[DF790A78-11AE-336D-91B9-598FA83DB34B]@0xffffff801a54f000->0xffffff801aaa9fff
            dependency: com.apple.driver.corecapture(1.0.4)[F86FE48A-AF97-3FA9-965C-BC40CE3E28CA]@0xffffff801ba25000->0xffffff801ba3efff
            dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[9B70EE1B-9CAB-3C79-BFDA-B70DC66A8450]@0xffffff801b1e0000->0xffffff801b1e4fff
            dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[210E54A5-E336-3882-B54C-16D88FD128FB]@0xffffff801a3ee000->0xffffff801a534fff
            dependency: com.apple.iokit.IONetworkingFamily(3.4)[58A9BF44-6CDC-3A24-A588-5D72E2378E2A]@0xffffff801af4d000->0xffffff801af63fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[897B72E0-B98F-30BA-8CB2-4E5E469CE4B6]@0xffffff801b1e7000->0xffffff801b211fff
            dependency: com.apple.iokit.IOSkywalkFamily(1.0)[F2724203-8AF4-39E2-841E-92B08446E426]@0xffffff801b2c6000->0xffffff801b30dfff

Process name corresponding to current thread (0xffffff90419e8000): kernel_task
Boot args: igfxrpsc=1 -igfxbls alcid=21 brcmfx-aspm=67 chunklist-security-epoch=0 -chunklist-no-rev2-dev chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
21D48

Kernel version:
Darwin Kernel Version 21.3.0: Wed Jan  5 21:37:58 PST 2022; root:xnu-8019.80.24~20/RELEASE_X86_64
Kernel UUID: 93729D02-FE6F-355B-BA76-BA930AA7103F
KernelCache slide: 0x0000000018400000
KernelCache base:  0xffffff8018600000
Kernel slide:      0x0000000018410000
Kernel text base:  0xffffff8018610000
__HIB  text base: 0xffffff8018500000
System model name: MacBookPro13,1 (Mac-473D31EABEB93F9B)
System shutdown begun: NO
Panic diags file available: YES (0x0)
Hibernation exit count: 0

System uptime in nanoseconds: 4119670952
Last Sleep:           absolute           base_tsc          base_nano
  Uptime  : 0x00000000f58d3865
  Sleep   : 0x0000000000000000 0x0000000000000000 0x0000000000000000
  Wake    : 0x0000000000000000 0x00000007e7a89e0d 0x0000000000000000
Zone info:
Foreign   : 0xffffff802f028000 - 0xffffff802f035000
Native    : 0xffffff804183b000 - 0xffffffa04183b000
Readonly  : 0xffffff850e507000 - 0xffffff86a7e9b000
Metadata  : 0xfffffff01c3bc000 - 0xfffffff03c4e5000
Bitmaps   : 0xfffffff03c4e5000 - 0xfffffff040ce5000
last started kext at 2848721144: as.acidanthera.BrcmPatchRAM3   2.6.1 (addr 0xffffff801cc0e000, size 53248)

[lvs1974]

@aben-ab: your panic report is useless for me, it does not contain any symbols. You have to use boot-arg keepsyms=1.

[abenraj]

@lvs1974 Sorry about that! Here is the log with the symbols:

panic(cpu 1 caller 0xffffff8013bd5bf3): Kernel trap at 0xffffff8013901082, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0xffffff9509dee000, CR3: 0x0000000029c2a000, CR4: 0x00000000003626e0
RAX: 0xffffffffffed3d00, RBX: 0xffffff9509cc1800, RCX: 0x0000000000000300, RDX: 0x0000000000000800
RSP: 0xffffffd04d94b7d8, RBP: 0xffffffd04d94b7f0, RSI: 0xffffff9509dee000, RDI: 0xffffff9509cc1d00
R8:  0x0000000000000004, R9:  0x0000000000000001, R10: 0x00000000ffffffff, R11: 0x00000000e0000000
R12: 0xffffff9509cc1800, R13: 0x0000000000000800, R14: 0xffffff9509dedb00, R15: 0x0000000000000000
RFL: 0x0000000000010286, RIP: 0xffffff8013901082, CS:  0x0000000000000008, SS:  0x0000000000000010
Fault CR2: 0xffffff9509dee000, Error code: 0x0000000000000000, Fault CPU: 0x1, PL: 0, VF: 10

Panicked task 0xffffff8b6fe19670: 119 threads: pid 0: kernel_task
Backtrace (CPU 1), panicked thread: 0xffffff8b6ffda540, Frame : Return Address
0xffffffd04d94b200 : 0xffffff8013a85ffd mach_kernel : _handle_debugger_trap + 0x41d
0xffffffd04d94b250 : 0xffffff8013be6035 mach_kernel : _kdp_i386_trap + 0x145
0xffffffd04d94b290 : 0xffffff8013bd5803 mach_kernel : _kernel_trap + 0x533
0xffffffd04d94b2e0 : 0xffffff8013a25a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd04d94b300 : 0xffffff8013a863cd mach_kernel : _DebuggerTrapWithState + 0xad
0xffffffd04d94b420 : 0xffffff8013a85b86 mach_kernel : _panic_trap_to_debugger + 0x2b6
0xffffffd04d94b480 : 0xffffff8014316409 mach_kernel : _panic + 0x54
0xffffffd04d94b4f0 : 0xffffff8013bd5bf3 mach_kernel : _sync_iss_to_iks + 0x2c3
0xffffffd04d94b670 : 0xffffff8013bd58d8 mach_kernel : _kernel_trap + 0x608
0xffffffd04d94b6c0 : 0xffffff8013a25a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd04d94b6e0 : 0xffffff8013901082 
0xffffffd04d94b7f0 : 0xffffff8015c5e11e com.apple.driver.AirPort.BrcmNIC : _otp_read_pci + 0xbd
0xffffffd04d94b840 : 0xffffff8017d50952 as.lvs1974.AirportBrcmFixup : __ZN6BRCMFX12otp_read_pciILm2EEExxxPvj + 0x72
0xffffffd04d94b880 : 0xffffff8015c5d0f9 com.apple.driver.AirPort.BrcmNIC : _initvars_srom_pci + 0x1bd
0xffffffd04d94b970 : 0xffffff8015c3e1d3 com.apple.driver.AirPort.BrcmNIC : _si_doattach + 0x9c1
0xffffffd04d94ba00 : 0xffffff8015c3d78c com.apple.driver.AirPort.BrcmNIC : _si_attach + 0x5c
0xffffffd04d94ba60 : 0xffffff8015a6828c com.apple.driver.AirPort.BrcmNIC : _wlc_attach + 0xaf
0xffffffd04d94bb20 : 0xffffff801597c3b2 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC8wlcStartEv + 0x198
0xffffffd04d94bbf0 : 0xffffff801597a938 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10startGatedEP9IOService + 0x444
0xffffffd04d94bc60 : 0xffffff801597a4e1 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10_doCommandEP8OSObjectPvS2_S2_S2_ + 0x4b
0xffffffd04d94bc90 : 0xffffff801425a0a0 mach_kernel : __ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2_S2_ + 0xb0
0xffffffd04d94bcf0 : 0xffffff801597b620 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC5startEP9IOService + 0x3dc
0xffffffd04d94bd60 : 0xffffff8017d4ecb9 as.lvs1974.AirportBrcmFixup : __ZN6BRCMFX5startEP9IOServiceS1_ + 0x309
0xffffffd04d94bdd0 : 0xffffff801422ebaa mach_kernel : __ZN9IOService14startCandidateEPS_ + 0x11a
0xffffffd04d94be30 : 0xffffff801422e715 mach_kernel : __ZN9IOService15probeCandidatesEP12OSOrderedSet + 0xe75
0xffffffd04d94bef0 : 0xffffff801422d710 mach_kernel : __ZN9IOService14doServiceMatchEj + 0x3d0
0xffffffd04d94bf50 : 0xffffff8014230779 mach_kernel : __ZN15_IOConfigThread4mainEPvi + 0x189
0xffffffd04d94bfa0 : 0xffffff8013a2518e mach_kernel : _call_continuation + 0x2e
      Kernel Extensions in backtrace:
         as.lvs1974.AirportBrcmFixup(2.1.4)[D72C0F46-3F9C-3339-93E5-747ECF8B6C28]@0xffffff8017d4b000->0xffffff8017d5efff
            dependency: as.vit9696.Lilu(1.5.9)[B051298C-0FFC-32A7-B0D6-CB0DE0B793C0]@0xffffff80179a9000->0xffffff80179d3fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[897B72E0-B98F-30BA-8CB2-4E5E469CE4B6]@0xffffff80165e7000->0xffffff8016611fff
         com.apple.driver.AirPort.BrcmNIC(1400.1.1)[DF790A78-11AE-336D-91B9-598FA83DB34B]@0xffffff801594f000->0xffffff8015ea9fff
            dependency: com.apple.driver.corecapture(1.0.4)[F86FE48A-AF97-3FA9-965C-BC40CE3E28CA]@0xffffff8016e25000->0xffffff8016e3efff
            dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[9B70EE1B-9CAB-3C79-BFDA-B70DC66A8450]@0xffffff80165e0000->0xffffff80165e4fff
            dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[210E54A5-E336-3882-B54C-16D88FD128FB]@0xffffff80157ee000->0xffffff8015934fff
            dependency: com.apple.iokit.IONetworkingFamily(3.4)[58A9BF44-6CDC-3A24-A588-5D72E2378E2A]@0xffffff801634d000->0xffffff8016363fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[897B72E0-B98F-30BA-8CB2-4E5E469CE4B6]@0xffffff80165e7000->0xffffff8016611fff
            dependency: com.apple.iokit.IOSkywalkFamily(1.0)[F2724203-8AF4-39E2-841E-92B08446E426]@0xffffff80166c6000->0xffffff801670dfff

Process name corresponding to current thread (0xffffff8b6ffda540): kernel_task
Boot args: igfxrpsc=1 -igfxbls alcid=21 brcmfx-aspm=67 keepsyms=1 chunklist-security-epoch=0 -chunklist-no-rev2-dev chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
21D48

Kernel version:
Darwin Kernel Version 21.3.0: Wed Jan  5 21:37:58 PST 2022; root:xnu-8019.80.24~20/RELEASE_X86_64
Kernel UUID: 93729D02-FE6F-355B-BA76-BA930AA7103F
KernelCache slide: 0x0000000013800000
KernelCache base:  0xffffff8013a00000
Kernel slide:      0x0000000013810000
Kernel text base:  0xffffff8013a10000
__HIB  text base: 0xffffff8013900000
System model name: MacBookPro13,1 (Mac-473D31EABEB93F9B)
System shutdown begun: NO
Panic diags file available: YES (0x0)
Hibernation exit count: 0

System uptime in nanoseconds: 4102053184
Last Sleep:           absolute           base_tsc          base_nano
  Uptime  : 0x00000000f4806549
  Sleep   : 0x0000000000000000 0x0000000000000000 0x0000000000000000
  Wake    : 0x0000000000000000 0x0000000792879835 0x0000000000000000
Zone info:
Foreign   : 0xffffff802a428000 - 0xffffff802a435000
Native    : 0xffffff803cbd7000 - 0xffffffa03cbd7000
Readonly  : 0xffffff85098a3000 - 0xffffff86a3237000
Metadata  : 0xffffffe3e583c000 - 0xffffffe405964000
Bitmaps   : 0xffffffe405964000 - 0xffffffe40a164000
last started kext at 2805037488: as.acidanthera.BrcmPatchRAM3   2.6.1 (addr 0xffffff801800e000, size 53248)

[lvs1974]

@aben-ab: is it a regular boot, or recovery / installation / update boot? Can you remove brcmfx-aspm=67 from boot-args and try again?

[abenraj]

@lvs1974 No issues on 12.2 recovery, only regular/install/update boot showing kp. Tried without aspm value boot-arg too, once again, after some successful reboots without KP, same KP again. I have to mention, this same card worked flawlessly with zero issues since Mojave up until 12.0 b4+.

Log for your kind perusal:

panic(cpu 1 caller 0xffffff8014dd5bf3): Kernel trap at 0xffffff8014b01082, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0xffffff950aede000, CR3: 0x000000002ae2a000, CR4: 0x00000000003626e0
RAX: 0xfffffff6666eed00, RBX: 0xffffff8b715cc800, RCX: 0x0000000000000300, RDX: 0x0000000000000800
RSP: 0xffffffd04e2137c8, RBP: 0xffffffd04e2137e0, RSI: 0xffffff950aede000, RDI: 0xffffff8b715ccd00
R8:  0x0000000000000004, R9:  0x0000000000000001, R10: 0x00000000ffffffff, R11: 0x00000000e0000000
R12: 0xffffff8b715cc800, R13: 0x0000000000000800, R14: 0xffffff950aeddb00, R15: 0x0000000000000000
RFL: 0x0000000000010286, RIP: 0xffffff8014b01082, CS:  0x0000000000000008, SS:  0x0000000000000000
Fault CR2: 0xffffff950aede000, Error code: 0x0000000000000000, Fault CPU: 0x1, PL: 0, VF: 10

Panicked task 0xffffff8b71249670: 118 threads: pid 0: kernel_task
Backtrace (CPU 1), panicked thread: 0xffffff950ab55000, Frame : Return Address
0xffffffd04e2131f0 : 0xffffff8014c85ffd mach_kernel : _handle_debugger_trap + 0x41d
0xffffffd04e213240 : 0xffffff8014de6035 mach_kernel : _kdp_i386_trap + 0x145
0xffffffd04e213280 : 0xffffff8014dd5803 mach_kernel : _kernel_trap + 0x533
0xffffffd04e2132d0 : 0xffffff8014c25a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd04e2132f0 : 0xffffff8014c863cd mach_kernel : _DebuggerTrapWithState + 0xad
0xffffffd04e213410 : 0xffffff8014c85b86 mach_kernel : _panic_trap_to_debugger + 0x2b6
0xffffffd04e213470 : 0xffffff8015516409 mach_kernel : _panic + 0x54
0xffffffd04e2134e0 : 0xffffff8014dd5bf3 mach_kernel : _sync_iss_to_iks + 0x2c3
0xffffffd04e213660 : 0xffffff8014dd58d8 mach_kernel : _kernel_trap + 0x608
0xffffffd04e2136b0 : 0xffffff8014c25a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd04e2136d0 : 0xffffff8014b01082 
0xffffffd04e2137e0 : 0xffffff8016e5e11e com.apple.driver.AirPort.BrcmNIC : _otp_read_pci + 0xbd
0xffffffd04e213830 : 0xffffff8018f50922 as.lvs1974.AirportBrcmFixup : __ZN6BRCMFX12otp_read_pciILm2EEExxxPvj + 0x72
0xffffffd04e213870 : 0xffffff8016e5d0f9 com.apple.driver.AirPort.BrcmNIC : _initvars_srom_pci + 0x1bd
0xffffffd04e213960 : 0xffffff8016e3e1d3 com.apple.driver.AirPort.BrcmNIC : _si_doattach + 0x9c1
0xffffffd04e2139f0 : 0xffffff8016e3d78c com.apple.driver.AirPort.BrcmNIC : _si_attach + 0x5c
0xffffffd04e213a50 : 0xffffff8016c6828c com.apple.driver.AirPort.BrcmNIC : _wlc_attach + 0xaf
0xffffffd04e213b10 : 0xffffff8016b7c3b2 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC8wlcStartEv + 0x198
0xffffffd04e213be0 : 0xffffff8016b7a938 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10startGatedEP9IOService + 0x444
0xffffffd04e213c50 : 0xffffff8016b7a4e1 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10_doCommandEP8OSObjectPvS2_S2_S2_ + 0x4b
0xffffffd04e213c80 : 0xffffff801545a0a0 mach_kernel : __ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2_S2_ + 0xb0
0xffffffd04e213ce0 : 0xffffff8016b7b620 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC5startEP9IOService + 0x3dc
0xffffffd04e213d50 : 0xffffff8018f4ec02 as.lvs1974.AirportBrcmFixup : __ZN6BRCMFX5startEP9IOServiceS1_ + 0x332
0xffffffd04e213dd0 : 0xffffff801542ebaa mach_kernel : __ZN9IOService14startCandidateEPS_ + 0x11a
0xffffffd04e213e30 : 0xffffff801542e715 mach_kernel : __ZN9IOService15probeCandidatesEP12OSOrderedSet + 0xe75
0xffffffd04e213ef0 : 0xffffff801542d710 mach_kernel : __ZN9IOService14doServiceMatchEj + 0x3d0
0xffffffd04e213f50 : 0xffffff8015430779 mach_kernel : __ZN15_IOConfigThread4mainEPvi + 0x189
0xffffffd04e213fa0 : 0xffffff8014c2518e mach_kernel : _call_continuation + 0x2e
      Kernel Extensions in backtrace:
         as.lvs1974.AirportBrcmFixup(2.1.4)[580137D7-E653-3D08-9C41-4B4E2B63AC5B]@0xffffff8018f4b000->0xffffff8018f5efff
            dependency: as.vit9696.Lilu(1.5.9)[B051298C-0FFC-32A7-B0D6-CB0DE0B793C0]@0xffffff8018ba9000->0xffffff8018bd3fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[897B72E0-B98F-30BA-8CB2-4E5E469CE4B6]@0xffffff80177e7000->0xffffff8017811fff
         com.apple.driver.AirPort.BrcmNIC(1400.1.1)[DF790A78-11AE-336D-91B9-598FA83DB34B]@0xffffff8016b4f000->0xffffff80170a9fff
            dependency: com.apple.driver.corecapture(1.0.4)[F86FE48A-AF97-3FA9-965C-BC40CE3E28CA]@0xffffff8018025000->0xffffff801803efff
            dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[9B70EE1B-9CAB-3C79-BFDA-B70DC66A8450]@0xffffff80177e0000->0xffffff80177e4fff
            dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[210E54A5-E336-3882-B54C-16D88FD128FB]@0xffffff80169ee000->0xffffff8016b34fff
            dependency: com.apple.iokit.IONetworkingFamily(3.4)[58A9BF44-6CDC-3A24-A588-5D72E2378E2A]@0xffffff801754d000->0xffffff8017563fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[897B72E0-B98F-30BA-8CB2-4E5E469CE4B6]@0xffffff80177e7000->0xffffff8017811fff
            dependency: com.apple.iokit.IOSkywalkFamily(1.0)[F2724203-8AF4-39E2-841E-92B08446E426]@0xffffff80178c6000->0xffffff801790dfff

Process name corresponding to current thread (0xffffff950ab55000): kernel_task
Boot args: igfxrpsc=1 -igfxbls alcid=21 keepsyms=1 chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
21D48

Kernel version:
Darwin Kernel Version 21.3.0: Wed Jan  5 21:37:58 PST 2022; root:xnu-8019.80.24~20/RELEASE_X86_64
Kernel UUID: 93729D02-FE6F-355B-BA76-BA930AA7103F
KernelCache slide: 0x0000000014a00000
KernelCache base:  0xffffff8014c00000
Kernel slide:      0x0000000014a10000
Kernel text base:  0xffffff8014c10000
__HIB  text base: 0xffffff8014b00000
System model name: MacBookPro13,1 (Mac-473D31EABEB93F9B)
System shutdown begun: NO
Panic diags file available: YES (0x0)
Hibernation exit count: 0

[lvs1974]

@aben-ab: thank you for the report and testing. I increased delays, could you test on more version, please? AirportBrcmFixup-2.1.4-DEBUG_11.zip

[Lorys89]

@aben-ab: thank you for the report and testing. I increased delays, could you test on more version, please? AirportBrcmFixup-2.1.4-DEBUG_11.zip

thanks for these kext, I tried this last one, start macos 12.2 and big sur already installed, the recovery of both and the installation from usb. do you want to do other tests? do you need ioreg or something else?

[abenraj]

@lvs1974 Once again, much thanks for your valuable time looking into this!

I tried with above version, similar kp again but now, at even later stage of the progress bar 😅

Attaching log below if any helpful:

panic(cpu 0 caller 0xffffff80051d5bf3): Kernel trap at 0xffffff8004f01082, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0xffffff94fa83a000, CR3: 0x000000001b22a000, CR4: 0x00000000003626e0
RAX: 0x00000004ccd8f500, RBX: 0xffffff99c75c9000, RCX: 0x0000000000000300, RDX: 0x0000000000000800
RSP: 0xffffffd04630b7d8, RBP: 0xffffffd04630b7f0, RSI: 0xffffff94fa83a000, RDI: 0xffffff99c75c9500
R8:  0x0000000000000004, R9:  0x0000000000000001, R10: 0x00000000ffffffff, R11: 0x00000000e0000000
R12: 0xffffff99c75c9000, R13: 0x0000000000000800, R14: 0xffffff94fa839b00, R15: 0x0000000000000000
RFL: 0x0000000000010206, RIP: 0xffffff8004f01082, CS:  0x0000000000000008, SS:  0x0000000000000000
Fault CR2: 0xffffff94fa83a000, Error code: 0x0000000000000000, Fault CPU: 0x0, PL: 0, VF: 10

Panicked task 0xffffff99c79ae670: 127 threads: pid 0: kernel_task
Backtrace (CPU 0), panicked thread: 0xffffff8b614ccaa0, Frame : Return Address
0xffffffd04630b200 : 0xffffff8005085ffd mach_kernel : _handle_debugger_trap + 0x41d
0xffffffd04630b250 : 0xffffff80051e6035 mach_kernel : _kdp_i386_trap + 0x145
0xffffffd04630b290 : 0xffffff80051d5803 mach_kernel : _kernel_trap + 0x533
0xffffffd04630b2e0 : 0xffffff8005025a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd04630b300 : 0xffffff80050863cd mach_kernel : _DebuggerTrapWithState + 0xad
0xffffffd04630b420 : 0xffffff8005085b86 mach_kernel : _panic_trap_to_debugger + 0x2b6
0xffffffd04630b480 : 0xffffff8005916409 mach_kernel : _panic + 0x54
0xffffffd04630b4f0 : 0xffffff80051d5bf3 mach_kernel : _sync_iss_to_iks + 0x2c3
0xffffffd04630b670 : 0xffffff80051d58d8 mach_kernel : _kernel_trap + 0x608
0xffffffd04630b6c0 : 0xffffff8005025a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd04630b6e0 : 0xffffff8004f01082 
0xffffffd04630b7f0 : 0xffffff800725e11e com.apple.driver.AirPort.BrcmNIC : _otp_read_pci + 0xbd
0xffffffd04630b840 : 0xffffff8009350942 as.lvs1974.AirportBrcmFixup : __ZN6BRCMFX12otp_read_pciILm2EEExxxPvj + 0x72
0xffffffd04630b870 : 0xffffff800725d0f9 com.apple.driver.AirPort.BrcmNIC : _initvars_srom_pci + 0x1bd
0xffffffd04630b960 : 0xffffff800723e1d3 com.apple.driver.AirPort.BrcmNIC : _si_doattach + 0x9c1
0xffffffd04630b9f0 : 0xffffff800723d78c com.apple.driver.AirPort.BrcmNIC : _si_attach + 0x5c
0xffffffd04630ba50 : 0xffffff800706828c com.apple.driver.AirPort.BrcmNIC : _wlc_attach + 0xaf
0xffffffd04630bb10 : 0xffffff8006f7c3b2 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC8wlcStartEv + 0x198
0xffffffd04630bbe0 : 0xffffff8006f7a938 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10startGatedEP9IOService + 0x444
0xffffffd04630bc50 : 0xffffff8006f7a4e1 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10_doCommandEP8OSObjectPvS2_S2_S2_ + 0x4b
0xffffffd04630bc80 : 0xffffff800585a0a0 mach_kernel : __ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2_S2_ + 0xb0
0xffffffd04630bce0 : 0xffffff8006f7b620 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC5startEP9IOService + 0x3dc
0xffffffd04630bd50 : 0xffffff800934ebe9 as.lvs1974.AirportBrcmFixup : __ZN6BRCMFX5startEP9IOServiceS1_ + 0x359
0xffffffd04630bdd0 : 0xffffff800582ebaa mach_kernel : __ZN9IOService14startCandidateEPS_ + 0x11a
0xffffffd04630be30 : 0xffffff800582e715 mach_kernel : __ZN9IOService15probeCandidatesEP12OSOrderedSet + 0xe75
0xffffffd04630bef0 : 0xffffff800582d710 mach_kernel : __ZN9IOService14doServiceMatchEj + 0x3d0
0xffffffd04630bf50 : 0xffffff8005830779 mach_kernel : __ZN15_IOConfigThread4mainEPvi + 0x189
0xffffffd04630bfa0 : 0xffffff800502518e mach_kernel : _call_continuation + 0x2e
      Kernel Extensions in backtrace:
         as.lvs1974.AirportBrcmFixup(2.1.4)[31E5DA23-5754-3960-A9F0-979C198FCDF0]@0xffffff800934b000->0xffffff800935efff
            dependency: as.vit9696.Lilu(1.5.9)[B051298C-0FFC-32A7-B0D6-CB0DE0B793C0]@0xffffff8008fa9000->0xffffff8008fd3fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[897B72E0-B98F-30BA-8CB2-4E5E469CE4B6]@0xffffff8007be7000->0xffffff8007c11fff
         com.apple.driver.AirPort.BrcmNIC(1400.1.1)[DF790A78-11AE-336D-91B9-598FA83DB34B]@0xffffff8006f4f000->0xffffff80074a9fff
            dependency: com.apple.driver.corecapture(1.0.4)[F86FE48A-AF97-3FA9-965C-BC40CE3E28CA]@0xffffff8008425000->0xffffff800843efff
            dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[9B70EE1B-9CAB-3C79-BFDA-B70DC66A8450]@0xffffff8007be0000->0xffffff8007be4fff
            dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[210E54A5-E336-3882-B54C-16D88FD128FB]@0xffffff8006dee000->0xffffff8006f34fff
            dependency: com.apple.iokit.IONetworkingFamily(3.4)[58A9BF44-6CDC-3A24-A588-5D72E2378E2A]@0xffffff800794d000->0xffffff8007963fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[897B72E0-B98F-30BA-8CB2-4E5E469CE4B6]@0xffffff8007be7000->0xffffff8007c11fff
            dependency: com.apple.iokit.IOSkywalkFamily(1.0)[F2724203-8AF4-39E2-841E-92B08446E426]@0xffffff8007cc6000->0xffffff8007d0dfff

Process name corresponding to current thread (0xffffff8b614ccaa0): kernel_task
Boot args: igfxrpsc=1 -igfxbls alcid=21 keepsyms=1 chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
21D48

Kernel version:
Darwin Kernel Version 21.3.0: Wed Jan  5 21:37:58 PST 2022; root:xnu-8019.80.24~20/RELEASE_X86_64
Kernel UUID: 93729D02-FE6F-355B-BA76-BA930AA7103F
KernelCache slide: 0x0000000004e00000
KernelCache base:  0xffffff8005000000
Kernel slide:      0x0000000004e10000
Kernel text base:  0xffffff8005010000
__HIB  text base: 0xffffff8004f00000
System model name: MacBookPro13,1 (Mac-473D31EABEB93F9B)
System shutdown begun: NO
Panic diags file available: YES (0x0)
Hibernation exit count: 0

System uptime in nanoseconds: 11232264447
Last Sleep:           absolute           base_tsc          base_nano
  Uptime  : 0x000000029d7ec8e7
  Sleep   : 0x0000000000000000 0x0000000000000000 0x0000000000000000
  Wake    : 0x0000000000000000 0x00000007804e223e 0x0000000000000000
Zone info:
Foreign   : 0xffffff801ba28000 - 0xffffff801ba35000
Native    : 0xffffff802e11e000 - 0xffffffa02e11e000
Readonly  : 0xffffff84fadea000 - 0xffffff869477e000
Metadata  : 0xfffffff8e653d000 - 0xfffffff906664000
Bitmaps   : 0xfffffff906664000 - 0xfffffff90ae64000

[dMatik02]

@lvs1974 first of all i haven't say thank you for the great job but I say it now, 12.1 (work all), 12.2 (recovery and install work, installed not working) but, take a look at this picture (idk how to log verbose to file, i extract the log after i boot the system).

This is taken from 12.2 installer (photo with phone) I think you uncovered a memory leak on apple side.

So this kp on 12.2 installed happens at a later stage and here is the culprit:

In the 12.2 installer we get past this line and it logs what you see in the photo, but when I try to boot the installed of 12.2, after this line we get kp:

IO80211Controller::start(IOService*)> IO80211Controller::start _controller is 0xc85ee49cd28912a9, provider is 0xc85ee4a66c14c6e9

panic(cpu 8 caller 0xffffff801cfd5c53): Kernel trap at 0xffffff801cd01082, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0xffffff954f69a000, CR3: 0x0000000032f65000, CR4: 0x00000000001626e0
RAX: 0xfffffff6677b3d00, RBX: 0xffffff8bb6e4d800, RCX: 0x0000000000000300, RDX: 0x0000000000000800
RSP: 0xffffffd08e3937c8, RBP: 0xffffffd08e3937e0, RSI: 0xffffff954f69a000, RDI: 0xffffff8bb6e4dd00
R8:  0x0000000000000004, R9:  0x0000000000000008, R10: 0x00000000ffffffff, R11: 0x00000000e0000000
R12: 0xffffff8bb6e4d800, R13: 0x0000000000000800, R14: 0xffffff954f699b00, R15: 0x0000000000000000
RFL: 0x0000000000010286, RIP: 0xffffff801cd01082, CS:  0x0000000000000008, SS:  0x0000000000000000
Fault CR2: 0xffffff954f69a000, Error code: 0x0000000000000000, Fault CPU: 0x8, PL: 0, VF: 10

Panicked task 0xffffff86e9dbd670: 130 threads: pid 0: kernel_task
Backtrace (CPU 8), panicked thread: 0xffffff954fdfeaa0, Frame : Return Address
0xffffffd08e3931f0 : 0xffffff801ce860fd mach_kernel : _handle_debugger_trap + 0x41d
0xffffffd08e393240 : 0xffffff801cfe6095 mach_kernel : _kdp_i386_trap + 0x145
0xffffffd08e393280 : 0xffffff801cfd5863 mach_kernel : _kernel_trap + 0x533
0xffffffd08e3932d0 : 0xffffff801ce25a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd08e3932f0 : 0xffffff801ce864cd mach_kernel : _DebuggerTrapWithState + 0xad
0xffffffd08e393410 : 0xffffff801ce85c86 mach_kernel : _panic_trap_to_debugger + 0x2b6
0xffffffd08e393470 : 0xffffff801d716259 mach_kernel : _panic + 0x54
0xffffffd08e3934e0 : 0xffffff801cfd5c53 mach_kernel : _sync_iss_to_iks + 0x2c3
0xffffffd08e393660 : 0xffffff801cfd5938 mach_kernel : _kernel_trap + 0x608
0xffffffd08e3936b0 : 0xffffff801ce25a60 mach_kernel : _return_from_trap + 0xe0
0xffffffd08e3936d0 : 0xffffff801cd01082 
0xffffffd08e3937e0 : 0xffffff801f05e11e com.apple.driver.AirPort.BrcmNIC : _otp_read_pci + 0xbd
0xffffffd08e393830 : 0xffffff8020df2922 as.lvs1974.AirportBrcmFixup : __ZN6BRCMFX12otp_read_pciILm2EEExxxPvj + 0x72
0xffffffd08e393870 : 0xffffff801f05d0f9 com.apple.driver.AirPort.BrcmNIC : _initvars_srom_pci + 0x1bd
0xffffffd08e393960 : 0xffffff801f03e1d3 com.apple.driver.AirPort.BrcmNIC : _si_doattach + 0x9c1
0xffffffd08e3939f0 : 0xffffff801f03d78c com.apple.driver.AirPort.BrcmNIC : _si_attach + 0x5c
0xffffffd08e393a50 : 0xffffff801ee6828c com.apple.driver.AirPort.BrcmNIC : _wlc_attach + 0xaf
0xffffffd08e393b10 : 0xffffff801ed7c3b2 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC8wlcStartEv + 0x198
0xffffffd08e393be0 : 0xffffff801ed7a938 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10startGatedEP9IOService + 0x444
0xffffffd08e393c50 : 0xffffff801ed7a4e1 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC10_doCommandEP8OSObjectPvS2_S2_S2_ + 0x4b
0xffffffd08e393c80 : 0xffffff801d659ef0 mach_kernel : __ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2_S2_ + 0xb0
0xffffffd08e393ce0 : 0xffffff801ed7b620 com.apple.driver.AirPort.BrcmNIC : __ZN15AirPort_BrcmNIC5startEP9IOService + 0x3dc
0xffffffd08e393d50 : 0xffffff8020df0c02 as.lvs1974.AirportBrcmFixup : __ZN6BRCMFX5startEP9IOServiceS1_ + 0x332
0xffffffd08e393dd0 : 0xffffff801d62e9fa mach_kernel : __ZN9IOService14startCandidateEPS_ + 0x11a
0xffffffd08e393e30 : 0xffffff801d62e565 mach_kernel : __ZN9IOService15probeCandidatesEP12OSOrderedSet + 0xe75
0xffffffd08e393ef0 : 0xffffff801d62d560 mach_kernel : __ZN9IOService14doServiceMatchEj + 0x3d0
0xffffffd08e393f50 : 0xffffff801d6305c9 mach_kernel : __ZN15_IOConfigThread4mainEPvi + 0x189
0xffffffd08e393fa0 : 0xffffff801ce2518e mach_kernel : _call_continuation + 0x2e
      Kernel Extensions in backtrace:
         as.lvs1974.AirportBrcmFixup(2.1.4)[580137D7-E653-3D08-9C41-4B4E2B63AC5B]@0xffffff8020ded000->0xffffff8020e00fff
            dependency: as.vit9696.Lilu(1.5.9)[B051298C-0FFC-32A7-B0D6-CB0DE0B793C0]@0xffffff8020da5000->0xffffff8020dcffff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[F0A7BE4E-A81A-34BE-B032-EF7E61FB3C46]@0xffffff801f9e7000->0xffffff801fa11fff
         com.apple.driver.AirPort.BrcmNIC(1400.1.1)[5836AF20-6464-3BF9-BD50-3312E2C73D90]@0xffffff801ed4f000->0xffffff801f2a9fff
            dependency: com.apple.driver.corecapture(1.0.4)[1A8E7B0A-B456-30AD-BD9F-7032D1A6E9DF]@0xffffff8020223000->0xffffff802023cfff
            dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[C294EE9A-A5C7-39F7-8756-A8E66AED42CE]@0xffffff801f9e0000->0xffffff801f9e4fff
            dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[9E78AAB8-75A1-3070-87E4-C0A1B34ABEF4]@0xffffff801ebee000->0xffffff801ed34fff
            dependency: com.apple.iokit.IONetworkingFamily(3.4)[8F50013F-1DAF-3503-8E71-6266FD3B3AD9]@0xffffff801f74d000->0xffffff801f763fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[F0A7BE4E-A81A-34BE-B032-EF7E61FB3C46]@0xffffff801f9e7000->0xffffff801fa11fff
            dependency: com.apple.iokit.IOSkywalkFamily(1.0)[D504070B-CF5A-36C4-8D49-7E9874EA6FA0]@0xffffff801fac6000->0xffffff801fb0dfff

Process name corresponding to current thread (0xffffff954fdfeaa0): kernel_task
Boot args: npci=0x3000 alcid=7 -v keepsyms=1 -bsdmgroot chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
Not yet set

Kernel version:
Darwin Kernel Version 21.3.0: Wed Dec  8 00:40:29 PST 2021; root:xnu-8019.80.11.111.1~1/RELEASE_X86_64
Kernel UUID: BF33B3E6-D84E-3D04-845D-DBC6A1CF4E3D
KernelCache slide: 0x000000001cc00000
KernelCache base:  0xffffff801ce00000
Kernel slide:      0x000000001cc10000
Kernel text base:  0xffffff801ce10000
__HIB  text base: 0xffffff801cd00000
System model name: iMacPro1,1 (Mac-7BA5B2D9E42DDD94)
System shutdown begun: NO
Panic diags file unavailable, panic occurred prior to initialization
Hibernation exit count: 0

System uptime in nanoseconds: 6120830329
Last Sleep:           absolute           base_tsc          base_nano
  Uptime  : 0x000000016eb5ad85
  Sleep   : 0x0000000000000000 0x0000000000000000 0x0000000000000000
  Wake    : 0x0000000000000000 0x0000048320671dd0 0x0000000000000000
Zone info:
Foreign   : 0xffffff803429a000 - 0xffffff80342a7000
Native    : 0xffffff80835e3000 - 0xffffffa0835e3000
Readonly  : 0xffffff85502af000 - 0xffffff86e9c43000
Metadata  : 0xffffffde43a45000 - 0xffffffde63f39000
Bitmaps   : 0xffffffde63f39000 - 0xffffffde75f39000

This is the log from 12.1 at that stage

IO80211Controller::start(IOService*)> IO80211Controller::start _controller is 0xc85ee49cd28912a9, provider is 0xc85ee4a66c14c6e9

PMRD: power event 7 args 0x82d7939b160667d 0x0

PMRD: PowerChangeOverride (ON_STATE->ON_STATE, f, 0x302) tag 0x220064

(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 5.467089: srom rev:11
(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 5.467402: ChangeVCO => vco:960, xtalF:40, frac: 98, ndivMode: 3, ndivint: 24
(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 5.467405: Data written into the PLL_CNTRL_ADDR2: 00000c31
(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 5.467418: Data written into the PLL_CNTRL_ADDR3 (Fractional): 0000100e

EDIT: all of above is tried with Debug 8, I try with debug 11 now, be back in a minute !

EDIT2: Debug 11 Boots 12.2 installed (be back with Logs)

EDIT3: Log from 12.2

IO80211FamilyLegacy`IO80211Controller::createIOReporters(IOService*)> IO80211Controller::createIOReporters 0x2dfe0ee8e67472e5
IO80211FamilyLegacy`IO80211Controller::logDebug(char const*, ...)>  CCFlags: 0x0, CCLevel: 5 ConsoleFlags: 0x0, ConsoleLevel: -1
IO80211FamilyLegacy`IO80211Controller::logDebug(char const*, ...)> Not adding subscription due to missing boot-arg wlan.iorsubscriptions
IO80211FamilyLegacy`IO80211Controller::logDebug(char const*, ...)>  CCFlags: 0x0, CCLevel: 5 ConsoleFlags: 0x0, ConsoleLevel: -1
IO80211FamilyLegacy`IO80211Controller::logDebug(char const*, ...)>  CCFlags: 0x0, CCLevel: 5 ConsoleFlags: 0x0, ConsoleLevel: -1
IO80211FamilyLegacy`IO80211Controller::findAndAttachToFaultReporter()> IO80211Controller::findAndAttachToFaultReporter no pipe found, making it
IO80211FamilyLegacy`IO80211RangingManager::initWithController(IO80211Controller*)> initWithController: Setting fWlanRanging80MHzBootArg to 0
IO80211Controller::start(IOService*)> IO80211Controller::start _controller is 0x2dfe0ee8e67472e5, provider is 0x2dfe0ef27fd307e5
PMRD: power event 7 args 0xc48cf5dd861b77ad 0x0
PMRD: PowerChangeOverride (ON_STATE->ON_STATE, f, 0x302) tag 0x330064
(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 16.379359: srom rev:11
(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 16.379660: ChangeVCO => vco:960, xtalF:40, frac: 98, ndivMode: 3, ndivint: 24
(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 16.379663: Data written into the PLL_CNTRL_ADDR2: 00000c31
(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 16.379676: Data written into the PLL_CNTRL_ADDR3 (Fractional): 0000100e
(AirPortBrcmNIC) <AirPortBrcmNIC`AirPort_BrcmNIC::wlcStart()> Setting property subsystem-id to:8659
(AirPortBrcmNIC) <AirPortBrcmNIC`AirPort_BrcmNIC::wlcStart()> Setting property subsystem-vendor-id to:106b
(IO80211FamilyLegacy) <IO80211FamilyLegacy`IO80211Interface::init(IONetworkController*)> init: error getting PHY_MODE;  using MODE_UNKNOWN
(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 16.690483: BRCM tunables:
(AirPortBrcmNIC) <AirPortBrcmNIC`osl_iolog_withtimestamp> ARPT: 16.690486:   pullmode[1] txringsize[  256] txsendqsize[0] reapmin[   32] reapcount[  128]
(AirPortBrcmNIC) <AirPortBrcmNIC`AirPort_BrcmNIC::startGated(IOService*)> wl0: Broadcom BCM43a0 802.11 Wireless Controller
7.77.111 (TOB) (r942877)
ARPT: 16.691193: wl0: Broadcom BCM43a0, vendorID[0x14e4] BAR0[0xfba00004]
7.77.111 (TOB) (r942877)
ARPT: 16.691214: Set packet allocation type to 1
PMRD: PowerChangeDone: ON_STATE->ON_STATE
ARPT: match category IODefaultMatchCategory exists

Here I can confirm AirportBrcmFixup-2.1.4-DEBUG_11 works in all (12.0.1, 12.1,12.2b) (Install, Recovery, Installed) will also update to 12.2rc to see. Thank you for your great work, much respect !

[lvs1974]

I had to increase delay dramatically (15 seconds). Please test it in all boot modes. After - I will make this delay value configurable (via boot-args or dev-properties).

AirportBrcmFixup-2.1.4-DEBUG_12.zip

[dMatik02]

For me DEBUG_11 works in all (12.0.1, 12.1, 12.2b - INSTALL, RECOVERY, INSTALLED), DEBUG_12 sometimes hang on 12.1 .

[abenraj]

Looks like the issue with legacy card BCM94360HMB 14e4:43a0 mini-PCIe not successfully initializing on Monterey has potentially been fixed with the handy delay workaround. @lvs1974 Can't thank you enough for the quick assistance!

I now think the issue with this peculiar non-persistent kp using DW1820A is prolly of another underlying issue with AirportBrcmNIC and needs to have its own thread. Trying with the latest DEBUG_12 now does not allow 12.2 RC installed to boot even once, persistent KP with Debug_12 on DW1820A to report.

[lvs1974]

This version supports boot-arg brcmfx-delay=[delay in milliseconds]. And dev-property brcmfx-delay (Number) is also supported. Now everybody can define his own delay (0 by default).

AirportBrcmFixup-2.1.4-DEBUG_13.zip

[Lorys89]

This version supports boot-arg brcmfx-delay=[delay in milliseconds]. And dev-property brcmfx-delay (Number) is also supported. Now everybody can define his own delay (0 by default).

AirportBrcmFixup-2.1.4-DEBUG_13.zip

at what value do you recommend setting the delay?

[lvs1974]

@Lorys89: you can start with 15000, and increase it you have boot with panics or freezes. Or decrease if everything is fine.

[Lorys89]

brcmfx-delay 15000 Number, is correct to dev-property?

[beelzebozox86]

Does this require debug version of OC?
Where do you set dev-property?

[dMatik02]

Does this require debug version of OC? Where do you set dev-property?

It’s easier to add brcmfx-delay=15000 in boot-args :D

[lvs1974]

@beelzebozox86: OC is not related to this issue. Dev-properties are set in config.plist, device path should match to your pci device (wi-fi card), you can check it in hackintool (right click - select copy DevicePath).

[beelzebozox86]

@beelzebozox86: OC is not related to this issue. Dev-properties are set in config.plist, PciRoot should match to your pci device (wi-fi card), you can check it in hackintool.

Got it.

I was able to boot now with BT and WIFI enabled in BIOS with just brcmfx-delay=15000 in boot-args, without dev-property values for that.

Thanks for the quick fix!

[Lorys89]

both ways are valid, thank you very much @lvs1974 thank you very much. are you waiting for other tests? or are you ready to push into the master?

[lvs1974]

@Lorys89: would be great if other people from this thread could test it, but it seems to be the only reliable solution. I'll push it in a few days.

[Lorys89]

@Lorys89: would be great if other people from this thread could test it, but it seems to be the only reliable solution. I'll push it in a few days.

the value 15000 works on everything, except usb installer macos 12.2, I get this log, if I raise the value to 30000 it starts usb installer but it doesn't start macos installed anymore and it doesn't start recovery 12.2 anymore. (I have tried all values ​​up to 30000)

panic(cpu 1 caller 0xffffff8011bd5ca3): Kernel trap at 0xffffff8011901082, type 14=page fault, registers: CR0: 0x000000008001003b, CR2: 0xffffff9028a8c000, CR3: 0x000000001bb0d000, CR4: 0x00000000001626e0 RAX: 0x00000009988f5500, RBX: 0xffffff99c1381000, RCX: 0x0000000000000300, RDX: 0x0000000000000800 RSP: 0xffffffd03ff13808, RBP: 0xffffffd03ff13820, RSI: 0xffffff9028a8c000, RDI: 0xffffff99c1381500 R8: 0x0000000000000004, R9: 0x0000000000000001, R10: 0x00000000ffffffff, R11: 0x00000000f8000000 R12: 0xffffff99c1381000, R13: 0x0000000000000800, R14: 0xffffff9028a8bb00, R15: 0x0000000000000000 RFL: 0x0000000000010206, RIP: 0xffffff8011901082, CS: 0x0000000000000008, SS: 0x0000000000000000 Fault CR2: 0xffffff9028a8c000, Error code: 0x0000000000000000, Fault CPU: 0x1, PL: 0, VF: 10

Panicked task 0xffffff99c16ba670: 97 threads: pid 0: kernel_task Backtrace (CPU 1), panicked thread: 0xffffff99c1658aa0, Frame : Return Address 0xffffffd03ff13230 : 0xffffff8011a860ad 0xffffffd03ff13280 : 0xffffff8011be60e5 0xffffffd03ff132c0 : 0xffffff8011bd58b3 0xffffffd03ff13310 : 0xffffff8011a25a60 0xffffffd03ff13330 : 0xffffff8011a8647d 0xffffffd03ff13450 : 0xffffff8011a85c36 0xffffffd03ff134b0 : 0xffffff80123164b9 0xffffffd03ff13520 : 0xffffff8011bd5ca3 0xffffffd03ff136a0 : 0xffffff8011bd5988 0xffffffd03ff136f0 : 0xffffff8011a25a60 0xffffffd03ff13710 : 0xffffff8011901082 0xffffffd03ff13820 : 0xffffff8013c5e11e 0xffffffd03ff13870 : 0xffffff8013c5d0f9 0xffffffd03ff13960 : 0xffffff8013c3e1d3 0xffffffd03ff139f0 : 0xffffff8013c3d78c 0xffffffd03ff13a50 : 0xffffff8013a6828c 0xffffffd03ff13b10 : 0xffffff801397c3b2 0xffffffd03ff13be0 : 0xffffff801397a938 0xffffffd03ff13c50 : 0xffffff801397a4e1 0xffffffd03ff13c80 : 0xffffff801225a150 0xffffffd03ff13ce0 : 0xffffff801397b620 0xffffffd03ff13d50 : 0xffffff8015c03da9 0xffffffd03ff13dd0 : 0xffffff801222ec5a 0xffffffd03ff13e30 : 0xffffff801222e7c5 0xffffffd03ff13ef0 : 0xffffff801222d7c0 0xffffffd03ff13f50 : 0xffffff8012230829 0xffffffd03ff13fa0 : 0xffffff8011a2518e Kernel Extensions in backtrace: as.lvs1974.AirportBrcmFixup(2.1.4)[8CC60CE8-0B68-3B01-96C4-7C1D7ADC71EF]@0xffffff8015c00000->0xffffff8015c13fff dependency: as.vit9696.Lilu(1.5.9)[B051298C-0FFC-32A7-B0D6-CB0DE0B793C0]@0xffffff80159a5000->0xffffff80159cffff dependency: com.apple.iokit.IOPCIFamily(2.9)[DF974D93-DFD9-38F6-9B03-BF11186B9AB2]@0xffffff80145e7000->0xffffff8014611fff com.apple.driver.AirPort.BrcmNIC(1400.1.1)[27962EB6-7706-311E-AC79-6A7A2AE373C8]@0xffffff801394f000->0xffffff8013ea9fff dependency: com.apple.driver.corecapture(1.0.4)[1A8E7B0A-B456-30AD-BD9F-7032D1A6E9DF]@0xffffff8014e24000->0xffffff8014e3dfff dependency: com.apple.driver.mDNSOffloadUserClient(1.0.1b8)[C294EE9A-A5C7-39F7-8756-A8E66AED42CE]@0xffffff80145e0000->0xffffff80145e4fff dependency: com.apple.iokit.IO80211FamilyLegacy(1200.12.2b1)[2A47FF07-E005-3BE5-8B94-653B46677A38]@0xffffff80137ee000->0xffffff8013934fff dependency: com.apple.iokit.IONetworkingFamily(3.4)[8F50013F-1DAF-3503-8E71-6266FD3B3AD9]@0xffffff801434d000->0xffffff8014363fff dependency: com.apple.iokit.IOPCIFamily(2.9)[DF974D93-DFD9-38F6-9B03-BF11186B9AB2]@0xffffff80145e7000->0xffffff8014611fff dependency: com.apple.iokit.IOSkywalkFamily(1.0)[D504070B-CF5A-36C4-8D49-7E9874EA6FA0]@0xffffff80146c6000->0xffffff801470dfff

Process name corresponding to current thread (0xffffff99c1658aa0): kernel_task Boot args: -v root-dmg=file:///BaseSystem/BaseSystem.dmg chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version: Not yet set

Kernel version: Darwin Kernel Version 21.3.0: Mon Jan 3 23:49:26 PST 2022; root:xnu-8019.80.24~15/RELEASE_X86_64 Kernel UUID: CE183058-7EF1-399E-9CFE-1417E98BCB84 KernelCache slide: 0x0000000011800000 KernelCache base: 0xffffff8011a00000 Kernel slide: 0x0000000011810000 Kernel text base: 0xffffff8011a10000 __HIB text base: 0xffffff8011900000 System model name: Macmini7,1 (Mac-35C5E08120C7EEAF) System shutdown begun: NO Panic diags file unavailable, panic occurred prior to initialization Hibernation exit count: 0

System uptime in nanoseconds: 16844623665 Last Sleep: absolute base_tsc base_nano Uptime : 0x00000003ecf0becc Sleep : 0x0000000000000000 0x0000000000000000 0x0000000000000000 Wake : 0x0000000000000000 0x0000001153315ded 0x0000000000000000 Zone info: Foreign : 0xffffff801c010000 - 0xffffff801c01d000 Native : 0xffffff8027eb2000 - 0xffffffa027eb2000 Readonly : 0xffffff84f4b7e000 - 0xffffff868e512000 Metadata : 0xffffffd89e0b3000 - 0xffffffd8be172000 Bitmaps : 0xffffffd8be172000 - 0xffffffd8c1172000

[lvs1974]

@Lorys89: I am afraid I cannot help here. It is not possible to distinguish install from recovery, so you will have to set up a proper delay when you install system from USB. Or may be just disable wi-fi card in BIOS during installation.

[Lorys89]

@aben-ab: thank you for the report and testing. I increased delays, could you test on more version, please? AirportBrcmFixup-2.1.4-DEBUG_11.zip

this version work good for me I just used this version to re install from 0 monterey 12.2 and then it starts well and works recovery, between this version of kext and the subsequent ones that changes?

[Lorys89]

for users running tests : you do not have to use bootarg for aspm or fix country or patch in dev-propieties concerned the wifi, disable them and try the debug11 version.