#include <kern/debug.h>

kern/debug.h Kernel.framework

includes: kern/kcdata.h, sys/appleapiopts.h, sys/cdefs.h, Kernel/stdint.h, Kernel/stdarg.h, uuid/uuid.h, Kernel/mach/boolean.h, Kernel/mach/kern_return.h, mach/vm_types.h, kern/panic_call.h, TargetConditionals.h

16 macros · 9 structs · 8 enums · 6 typedefs · 1 function · 1 variable

structthread_snapshot

An old-style snapshot for a thread. See `struct microstackshot_thread` for microstackshot-specific fields. XXX This is ABI for tools and the order of its fields must not change.

size 316, align 1 · packed

uint32_t	snapshot_magic
uint32_t	nkern_frames
uint32_t	nuser_frames
uint64_t	wait_event
uint64_t	continuation
uint64_t	thread_id
uint64_t	user_time
uint64_t	system_time
int32_t	state
int32_t	priority	static priority
int32_t	sched_pri	scheduled (current) priority
int32_t	sched_flags	scheduler flags
char	ss_flags
char	ts_qos	effective qos
char	ts_rqos	requested qos
char	ts_rqos_override	requested qos override
char	io_tier
char[3]	_reserved	pad for 4 byte alignement packing
uint64_t	disk_reads_count
uint64_t	disk_reads_size
uint64_t	disk_writes_count
uint64_t	disk_writes_size
uint64_t[4]	io_priority_count
uint64_t[4]	io_priority_size
uint64_t	paging_count
uint64_t	paging_size
uint64_t	non_paging_count
uint64_t	non_paging_size
uint64_t	data_count
uint64_t	data_size
uint64_t	metadata_count
uint64_t	metadata_size
uint64_t	voucher_identifier	obfuscated voucher identifier
uint64_t	total_syscalls
char[64]	pth_name

structtask_snapshot

An old-style snapshot for a task. See `struct microstackshot_task` for the microstackshot-specific field meanings. XXX This is ABI for tools and the order of its fields must not change.

size 293, align 1 · packed

uint32_t	snapshot_magic
int32_t	pid
uint64_t	uniqueid
uint64_t	user_time_in_terminated_threads
uint64_t	system_time_in_terminated_threads
uint8_t[16]	shared_cache_identifier
uint64_t	shared_cache_slide
uint32_t	nloadinfos
int	suspend_count
int	task_size	pages
int	faults	number of page faults
int	pageins	number of actual pageins
int	cow_faults	number of copy-on-write faults
uint32_t	ss_flags
uint64_t	p_start_sec	from the bsd proc struct
uint64_t	p_start_usec	from the bsd proc struct
char[17]	p_comm	We restrict ourselves to a statically defined (current as of 2009) length for the p_comm string, due to scoping issues (osfmk/bsd and user/kernel binary compatibility).
uint32_t	was_throttled
uint32_t	did_throttle
uint32_t	latency_qos
uint64_t	disk_reads_count	I/O Statistics XXX: These fields must be together.
uint64_t	disk_reads_size
uint64_t	disk_writes_count
uint64_t	disk_writes_size
uint64_t[4]	io_priority_count
uint64_t[4]	io_priority_size
uint64_t	paging_count
uint64_t	paging_size
uint64_t	non_paging_count
uint64_t	non_paging_size
uint64_t	data_count
uint64_t	data_size
uint64_t	metadata_count
uint64_t	metadata_size
uint32_t	donating_pid_count

structmicro_snapshot

size 27, align 1 · packed

uint32_t	snapshot_magic
uint32_t	ms_cpu	cpu number this snapshot was recorded on
uint64_t	ms_time	time at sample (seconds)
uint64_t	ms_time_microsecs
uint8_t	ms_flags
uint16_t	ms_opaque_flags	managed by external entity, e.g. fdrmicrod

struct_dyld_cache_header

mirrors the dyld_cache_header struct defined in dyld_cache_format.h from dyld source code

size 224, align 8

char[16]	magic	e.g. "dyld_v0 i386"
uint32_t	mappingOffset	file offset to first dyld_cache_mapping_info
uint32_t	mappingCount	number of dyld_cache_mapping_info entries
uint32_t	imagesOffset	file offset to first dyld_cache_image_info
uint32_t	imagesCount	number of dyld_cache_image_info entries
uint64_t	dyldBaseAddress	base address of dyld when cache was built
uint64_t	codeSignatureOffset	file offset of code signature blob
uint64_t	codeSignatureSize	size of code signature blob (zero means to end of file)
uint64_t	slideInfoOffset	file offset of kernel slid info
uint64_t	slideInfoSize	size of kernel slid info
uint64_t	localSymbolsOffset	file offset of where local symbols are stored
uint64_t	localSymbolsSize	size of local symbols information
uint8_t[16]	uuid	unique value for each shared cache file
uint64_t	cacheType	0 for development, 1 for production
uint32_t	branchPoolsOffset	file offset to table of uint64_t pool addresses
uint32_t	branchPoolsCount	number of uint64_t entries
uint64_t	accelerateInfoAddr	(unslid) address of optimization info
uint64_t	accelerateInfoSize	size of optimization info
uint64_t	imagesTextOffset	file offset to first dyld_cache_image_text_info
uint64_t	imagesTextCount	number of dyld_cache_image_text_info entries
uint64_t	dylibsImageGroupAddr	(unslid) address of ImageGroup for dylibs in this cache
uint64_t	dylibsImageGroupSize	size of ImageGroup for dylibs in this cache
uint64_t	otherImageGroupAddr	(unslid) address of ImageGroup for other OS dylibs
uint64_t	otherImageGroupSize	size of oImageGroup for other OS dylibs
uint64_t	progClosuresAddr	(unslid) address of list of program launch closures
uint64_t	progClosuresSize	size of list of program launch closures
uint64_t	progClosuresTrieAddr	(unslid) address of trie of indexes into program launch closures
uint64_t	progClosuresTrieSize	size of trie of indexes into program launch closures
uint32_t	platform	platform number (macOS=1, etc)
uint32_t:8	formatVersion	dyld3::closure::kFormatVersion
uint32_t:1	dylibsExpectedOnDisk	dyld should expect the dylib exists on disk and to compare inode/mtime to see if cache is valid
uint32_t:1	simulator	for simulator of specified platform
uint32_t:1	locallyBuiltCache	0 for B&I built cache, 1 for locally built cache
uint32_t:21	padding	TBD

struct_dyld_cache_image_text_info

mirrors the dyld_cache_image_text_info struct defined in dyld_cache_format.h from dyld source code

size 32, align 8

uuid_t	uuid
uint64_t	loadAddress	unslid address of start of __TEXT
uint32_t	textSegmentSize
uint32_t	pathOffset	offset from start of cache file

enummicro_snapshot_flags

underlying type unsigned int

kPageGrabRecord	2	triggered by a page grab
kUserMode	4	interrupted user space
kIORecord	8	triggered by I/O writes
kPMIRecord	16	triggered by a CPU Performance Monitor Interrupt
kMACFRecord	32	armed by MACF policy
kKernelThread	64	sampled a kernel thread
kVMFaultRecord	128	triggered by VM fault
kInterruptRecord	1	triggered by a timer interrupt
kTimerArmingRecord	2	triggered by arming a timer, repurposed

enumgeneric_snapshot_flags

Flags used in the following assortment of snapshots.

underlying type unsigned int

kUser64_p	1	Userspace uses 64 bit pointers
kKernel64_p	2	The kernel uses 64 bit pointers

enumstackshot_flags_t

underlying type uint64_t

STACKSHOT_GET_DQ	1
STACKSHOT_SAVE_LOADINFO	2
STACKSHOT_GET_GLOBAL_MEM_STATS	4
STACKSHOT_SAVE_KEXT_LOADINFO	8
STACKSHOT_ACTIVE_KERNEL_THREADS_ONLY	256
STACKSHOT_GET_BOOT_PROFILE	512
STACKSHOT_DO_COMPRESS	1024
STACKSHOT_SAVE_IMP_DONATION_PIDS	8192
STACKSHOT_SAVE_IN_KERNEL_BUFFER	16384
STACKSHOT_RETRIEVE_EXISTING_BUFFER	32768
STACKSHOT_KCDATA_FORMAT	65536
STACKSHOT_ENABLE_BT_FAULTING	131072
STACKSHOT_COLLECT_DELTA_SNAPSHOT	262144
STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT	524288
STACKSHOT_TRYLOCK	1048576
STACKSHOT_ENABLE_UUID_FAULTING	2097152
STACKSHOT_FROM_PANIC	4194304
STACKSHOT_NO_IO_STATS	8388608
STACKSHOT_THREAD_WAITINFO	16777216
STACKSHOT_THREAD_GROUP	33554432
STACKSHOT_SAVE_JETSAM_COALITIONS	67108864
STACKSHOT_INSTRS_CYCLES	134217728
STACKSHOT_ASID	268435456
STACKSHOT_PAGE_TABLES	536870912
STACKSHOT_DISABLE_LATENCY_INFO	1073741824
STACKSHOT_SAVE_DYLD_COMPACTINFO	2147483648
STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL	4294967296
STACKSHOT_EXCLAVES	8589934592
STACKSHOT_SKIP_EXCLAVES	17179869184
STACKSHOT_MTEINFO	34359738368

typedefstackshot_flags_t

typedef enum stackshot_flags_t stackshot_flags_t;

enummicrostackshot_flags_t

underlying type uint32_t

STACKSHOT_GET_KERNEL_MICROSTACKSHOT	8
STACKSHOT_GET_MICROSTACKSHOT	16
STACKSHOT_GLOBAL_MICROSTACKSHOT_ENABLE	32
STACKSHOT_GLOBAL_MICROSTACKSHOT_DISABLE	64
STACKSHOT_SET_MICROSTACKSHOT_MARK	128

typedefmicrostackshot_flags_t

typedef enum microstackshot_flags_t microstackshot_flags_t;

enumtelemetry_notice_t

underlying type uint32_t

TELEMETRY_NOTICE_BASE	0
TELEMETRY_NOTICE_KERNEL_MICROSTACKSHOT	1

typedeftelemetry_notice_t

typedef enum telemetry_notice_t telemetry_notice_t;

macroSTACKSHOT_THREAD_SNAPSHOT_MAGIC

#define STACKSHOT_THREAD_SNAPSHOT_MAGIC 0xfeedface

macroSTACKSHOT_TASK_SNAPSHOT_MAGIC

#define STACKSHOT_TASK_SNAPSHOT_MAGIC 0xdecafbad

macroSTACKSHOT_MEM_AND_IO_SNAPSHOT_MAGIC

#define STACKSHOT_MEM_AND_IO_SNAPSHOT_MAGIC 0xbfcabcde

macroSTACKSHOT_MICRO_SNAPSHOT_MAGIC

#define STACKSHOT_MICRO_SNAPSHOT_MAGIC 0x31c54011

macroSTACKSHOT_PAGETABLES_MASK_ALL

#define STACKSHOT_PAGETABLES_MASK_ALL ~0

enumkf_override_flag_t

underlying type uint32_t

KF_SERIAL_OVRD	2
KF_PMAPV_OVRD	4
KF_MATV_OVRD	8
KF_STACKSHOT_OVRD	16
KF_COMPRSV_OVRD	32
KF_INTERRUPT_MASKED_DEBUG_OVRD	64
KF_TRAPTRACE_OVRD	128
KF_IOTRACE_OVRD	256
KF_INTERRUPT_MASKED_DEBUG_STACKSHOT_OVRD	512
KF_SCHED_HYGIENE_DEBUG_PMC_OVRD	1024
KF_MACH_ASSERT_OVRD	2048
KF_MADVISE_FREE_DEBUG_OVRD	4096
KF_DISABLE_FP_POPC_ON_PGFLT	8192
KF_DISABLE_PROD_TRC_VALIDATION	16384
KF_IO_TIMEOUT_OVRD	32768
KF_PREEMPTION_DISABLED_DEBUG_OVRD	65536
KF_DISABLE_PROCREF_TRACKING_OVRD	131072

typedefkf_override_flag_t

typedef enum kf_override_flag_t kf_override_flag_t;

macroKF_SERVER_PERF_MODE_OVRD

#define KF_SERVER_PERF_MODE_OVRD (
	KF_SERIAL_OVRD |
	KF_PMAPV_OVRD |
	KF_MATV_OVRD |
	KF_COMPRSV_OVRD |
	KF_INTERRUPT_MASKED_DEBUG_OVRD |
	KF_TRAPTRACE_OVRD |
	KF_IOTRACE_OVRD  |
	KF_SCHED_HYGIENE_DEBUG_PMC_OVRD |
	KF_MACH_ASSERT_OVRD |
	KF_MADVISE_FREE_DEBUG_OVRD |
	KF_DISABLE_PROD_TRC_VALIDATION |
	0)

functionkern_feature_override

boolean_t kern_feature_override(kf_override_flag_t fmask)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu osfmk/kern/debug.c

Returns TRUE if every bit in fmask is set in the kernel feature override mask, initialized from the validation_disables boot-arg (with serverperfmode=1 implying KF_SERVER_PERF_MODE_OVRD). Kernel subsystems use it to check whether a debugging or validation feature has been overridden (disabled) for this boot; the kf_override_flag_t bits include KF_SERIAL_OVRD, KF_STACKSHOT_OVRD, KF_INTERRUPT_MASKED_DEBUG_OVRD, KF_MACH_ASSERT_OVRD, KF_IO_TIMEOUT_OVRD and others declared in kern/debug.h.

enumeph_panic_flags_t

underlying type uint64_t

EMBEDDED_PANIC_HEADER_FLAG_COREDUMP_COMPLETE	1
EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_SUCCEEDED	2
EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_FAILED_DEBUGGERSYNC	4
EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_FAILED_ERROR	8
EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_FAILED_INCOMPLETE	16
EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_FAILED_NESTED	32
EMBEDDED_PANIC_HEADER_FLAG_NESTED_PANIC	64
EMBEDDED_PANIC_HEADER_FLAG_BUTTON_RESET_PANIC	128
EMBEDDED_PANIC_HEADER_FLAG_COMPANION_PROC_INITIATED_PANIC	256
EMBEDDED_PANIC_HEADER_FLAG_COREDUMP_FAILED	512
EMBEDDED_PANIC_HEADER_FLAG_COMPRESS_FAILED	1024
EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_DATA_COMPRESSED	2048
EMBEDDED_PANIC_HEADER_FLAG_ENCRYPTED_COREDUMP_SKIPPED	4096
EMBEDDED_PANIC_HEADER_FLAG_KERNEL_COREDUMP_SKIPPED_EXCLUDE_REGIONS_UNAVAILABLE	8192
EMBEDDED_PANIC_HEADER_FLAG_COREFILE_UNLINKED	16384
EMBEDDED_PANIC_HEADER_FLAG_INCOHERENT_PANICLOG	32768
EMBEDDED_PANIC_HEADER_FLAG_EXCLAVE_PANIC	65536
EMBEDDED_PANIC_HEADER_FLAG_USERSPACE_INITIATED_PANIC	131072
EMBEDDED_PANIC_HEADER_FLAG_INTEGRATED_COPROC_INITIATED_PANIC	262144

typedefeph_panic_flags_t

typedef enum eph_panic_flags_t eph_panic_flags_t;

macroMAX_PANIC_INITIATOR_SIZE

#define MAX_PANIC_INITIATOR_SIZE 256

macroEMBEDDED_PANIC_HEADER_CURRENT_VERSION

#define EMBEDDED_PANIC_HEADER_CURRENT_VERSION 8

macroEMBEDDED_PANIC_MAGIC

#define EMBEDDED_PANIC_MAGIC 0x46554E4B

FUNK

macroEMBEDDED_PANIC_HEADER_OSVERSION_LEN

#define EMBEDDED_PANIC_HEADER_OSVERSION_LEN 32

structembedded_panic_header

Any updates to this header should be also updated in astris as it can not grab this header from the SDK. NOTE: DO NOT REMOVE OR CHANGE THE MEANING OF ANY FIELDS FROM THIS STRUCTURE. Any modifications should add new fields at the end, bump the version number and be done alongside astris and DumpPanic changes.

size 225, align 1 · packed

uint32_t	eph_magic	EMBEDDED_PANIC_MAGIC if valid
uint32_t	eph_crc	CRC of everything following the ph_crc in the header and the contents
uint32_t	eph_version	embedded_panic_header version
eph_panic_flags_t	eph_panic_flags	Flags indicating any state or relevant details
uint32_t	eph_panic_log_offset	Offset of the beginning of the panic log from the beginning of the header
uint32_t	eph_panic_log_len	length of the panic log
uint32_t	eph_stackshot_offset	Offset of the beginning of the panic stackshot from the beginning of the header
uint32_t	eph_stackshot_len	length of the panic stackshot (0 if not valid )
uint32_t	eph_other_log_offset	Offset of the other log (any logging subsequent to the stackshot) from the beginning of the header
uint32_t	eph_other_log_len	length of the other log
char[32]	eph_os_version
char[32]	eph_macos_version
uuid_string_t	eph_bootsessionuuid_string	boot session UUID
uint64_t	eph_roots_installed	bitmap indicating which roots are installed on this system
uint32_t	eph_ext_paniclog_offset
uint32_t	eph_ext_paniclog_len
uint32_t	eph_panic_initiator_offset
uint32_t	eph_panic_initiator_len
char[16]	eph_device_target_type	Device-specific target type buffer
char[32]	eph_device_model_type	Device-specific model type buffer

macroMACOS_PANIC_HEADER_CURRENT_VERSION

#define MACOS_PANIC_HEADER_CURRENT_VERSION 3

macroMACOS_PANIC_MAGIC

#define MACOS_PANIC_MAGIC 0x44454544

DEED

enummph_panic_flags_t

underlying type uint64_t

MACOS_PANIC_HEADER_FLAG_NESTED_PANIC	1
MACOS_PANIC_HEADER_FLAG_COMPANION_PROC_INITIATED_PANIC	2
MACOS_PANIC_HEADER_FLAG_STACKSHOT_SUCCEEDED	4
MACOS_PANIC_HEADER_FLAG_STACKSHOT_DATA_COMPRESSED	8
MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_DEBUGGERSYNC	16
MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_ERROR	32
MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_INCOMPLETE	64
MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_NESTED	128
MACOS_PANIC_HEADER_FLAG_COREDUMP_COMPLETE	256
MACOS_PANIC_HEADER_FLAG_COREDUMP_FAILED	512
MACOS_PANIC_HEADER_FLAG_STACKSHOT_KERNEL_ONLY	1024
MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_COMPRESS	2048
MACOS_PANIC_HEADER_FLAG_ENCRYPTED_COREDUMP_SKIPPED	4096
MACOS_PANIC_HEADER_FLAG_KERNEL_COREDUMP_SKIPPED_EXCLUDE_REGIONS_UNAVAILABLE	8192
MACOS_PANIC_HEADER_FLAG_COREFILE_UNLINKED	16384
MACOS_PANIC_HEADER_FLAG_INCOHERENT_PANICLOG	32768
MACOS_PANIC_HEADER_FLAG_USERSPACE_INITIATED_PANIC	65536
MACOS_PANIC_HEADER_FLAG_INTEGRATED_COPROC_INITIATED_PANIC	131072

typedefmph_panic_flags_t

typedef enum mph_panic_flags_t mph_panic_flags_t;

structmacos_panic_header

size 56, align 1 · packed

uint32_t	mph_magic	MACOS_PANIC_MAGIC if valid
uint32_t	mph_crc	CRC of everything following mph_crc in the header and the contents
uint32_t	mph_version	macos_panic_header version
uint32_t	mph_padding	unused
mph_panic_flags_t	mph_panic_flags	Flags indicating any state or relevant details
uint32_t	mph_panic_log_offset	Offset of the panic log from the beginning of the header
uint32_t	mph_panic_log_len	length of the panic log
uint32_t	mph_stackshot_offset	Offset of the panic stackshot from the beginning of the header
uint32_t	mph_stackshot_len	length of the panic stackshot
uint32_t	mph_other_log_offset	Offset of the other log (any logging subsequent to the stackshot) from the beginning of the header
uint32_t	mph_other_log_len	length of the other log
uint64_t	mph_roots_installed	bitmap indicating which roots are installed on this system
char[]	mph_data	panic data -- DO NOT ACCESS THIS FIELD DIRECTLY. Use the offsets above relative to the beginning of the header

structefi_aurr_panic_header

size 24, align 1 · packed

uint32_t	efi_aurr_magic
uint32_t	efi_aurr_crc
uint32_t	efi_aurr_version
uint32_t	efi_aurr_reset_cause
uint32_t	efi_aurr_reset_log_offset
uint32_t	efi_aurr_reset_log_len
char[]	efi_aurr_panic_data

macroEXTENDED_DEBUG_BUF_SIZE

EXTENDED_/DEBUG_BUF_SIZE can't grow without updates to SMC and iBoot to store larger panic logs on co-processor systems

#define EXTENDED_DEBUG_BUF_SIZE 0x0013ff80

macroEFI_AURR_PANIC_STRING_MAX_LEN

#define EFI_AURR_PANIC_STRING_MAX_LEN 112

macroEFI_AURR_EXTENDED_LOG_SIZE

#define EFI_AURR_EXTENDED_LOG_SIZE (EXTENDED_DEBUG_BUF_SIZE - sizeof(struct efi_aurr_panic_header) - EFI_AURR_PANIC_STRING_MAX_LEN)

structefi_aurr_extended_panic_log

size 1310464, align 1 · packed

char[1310456]	efi_aurr_extended_log_buf
uint32_t	efi_aurr_log_tail	Circular buffer indices
uint32_t	efi_aurr_log_head	ditto..

variableecc_panic_physical_address

If non-zero, this physical address had an ECC error that led to a panic.

extern uint64_t ecc_panic_physical_address

kern/debug.h Kernel.framework

structthread_snapshot

structtask_snapshot

structmicro_snapshot

struct_dyld_cache_header

struct_dyld_cache_image_text_info

enummicro_snapshot_flags

enumgeneric_snapshot_flags

macroVM_PRESSURE_TIME_WINDOW

enumstackshot_flags_t

typedefstackshot_flags_t

enummicrostackshot_flags_t

typedefmicrostackshot_flags_t

enumtelemetry_notice_t

typedeftelemetry_notice_t

macroSTACKSHOT_THREAD_SNAPSHOT_MAGIC

macroSTACKSHOT_TASK_SNAPSHOT_MAGIC

macroSTACKSHOT_MEM_AND_IO_SNAPSHOT_MAGIC

macroSTACKSHOT_MICRO_SNAPSHOT_MAGIC

macroSTACKSHOT_PAGETABLES_MASK_ALL

enumkf_override_flag_t

typedefkf_override_flag_t

macroKF_SERVER_PERF_MODE_OVRD

functionkern_feature_override

enumeph_panic_flags_t

typedefeph_panic_flags_t

macroMAX_PANIC_INITIATOR_SIZE

macroEMBEDDED_PANIC_HEADER_CURRENT_VERSION

macroEMBEDDED_PANIC_MAGIC

macroEMBEDDED_PANIC_HEADER_OSVERSION_LEN

structembedded_panic_header

macroMACOS_PANIC_HEADER_CURRENT_VERSION

macroMACOS_PANIC_MAGIC

enummph_panic_flags_t

typedefmph_panic_flags_t

structmacos_panic_header

structefi_aurr_panic_header

macroEXTENDED_DEBUG_BUF_SIZE

macroEFI_AURR_PANIC_STRING_MAX_LEN

macroEFI_AURR_EXTENDED_LOG_SIZE

structefi_aurr_extended_panic_log

variableecc_panic_physical_address