Troublesome kext or driver causing system to hang

Question

I have a late 2012 27" iMac with a relatively fresh install of OS X Mountain Lion (10.8.2). I have been experiencing a pretty severe problem that I am convinced is software related, but I could use some assistance in finding the best way to track it down.

The problem is this: any time I leave the computer unattended for any length of time (ranging from minutes to hours), I come back to it and there is about an 80% chance that the system will have hung. I can move the mouse, but the cursor is the spinning beach ball and I can't click on anything, interact with anything, or type anything. The only way to get the computer out of this state, consistently, is to hold the power button and force a restart.

I've narrowed this problem down with some certainty to being related to my Seagate GoFlex Desk 3 TB external hard drive. Strangely, this drive required a driver to be installed from Seagate before it would show up connected via the attached Thunderbolt dock. There's a post here on Seagate's website that addresses some similar concerns with a similar drive. I did install that driver, which seemed to make the issue much worse, but I swear this issue may have been there before all this (I can't remember with certainty).

1. If I disconnect the drive entirely, the problem goes away.
2. If I boot the system into Safe Mode (with Shift held down), the problem also goes away.

Now, I've diligently gone through and removed everything I could find that was installed along with this driver. I opened up the installer and went to Show Files and removed everything it installed. I even searched my /Library and /System folders for anything with "Seagate" in the name, and killed all of it. But the problem still remains.

Booting into Safe Mode and having the problem go away tells me there is a software component here that is causing this mayhem. What I would like to ask for assistance with is how best to try and hunt down the driver, or kext, or application, or whatever it might be that is causing the system to hang like this.

I'm probably going to end up replacing this drive anyway, because this is just ridiculous, but in the meantime, it hosts a lot of important data and I'd really like to get my system working again with the drive by disabling whatever is so consistently causing it to hang.

Thanks so much for any help!

Answer 1

Here is a method to hunt the kext which may cause you a hang system.

1. Boot in safe mode & make a capture of the minimal safe set of extenions loaded with:

   mkdir ~/tmp
   kextstat >~/tmp/safe.kextstat
   

2. Boot in normal mode & make a capture of the full set of extensions loaded with:

   kextstat >~/tmp/full.kextstat
   

3. Compare them:

   cd ~/tmp
   diff full.kextstat safe.kextstat
   

   and from this difference, which is including the faulty kext, extract the culprit by checking its installation date:

   ls -dlT /System/Library/Extensions/<extension_folder_name…>
   

   The faulty extension will be the one installed at the time of the start of your kernel hang.

   Beware: the extension_folder_name… is not the extension name as displayed by kexstat.

   Here is an example:

   on_my_mac$ kextstat | egrep 'Addr|ThunderboltDPA'
   Index Refs Address            Size       Wired      Name (Version) <Linked Against>
      70    4 0xffffff7f8125e000 0x8000     0x8000     com.apple.driver.AppleThunderboltDPAdapterFamily (1.8.2) <45 9 8 5 4 3>
   on_my_mac$
   

   is coming from:

   on_my_mac$ cd /System/Library/Extensions
   on_my_mac$ ls -dlT AppleThunderboltDPAdapters.kext
   drwxr-xr-x  3 root  wheel  102 Aug 31 05:39:06 2011 AppleThunderboltDPAdapters.kext
   on_my_mac$
   

4. Make a backup copy of the suspected extension:

   mkdir ~/Extensions_backup
   cd /System/Library/Extensions
   /usr/bin/sudo mv faulty_extension_folder_name ~/Extensions_backup
   

   and test this system with one missing kernel extension:

   reboot
   

5. If it is OK. You got the right culprit.

   If not. Just reverse step 4, reboot and repeat from step 4 to test the next potential extension.