We're seeing a recurring kernel panic across six Mac17-family Macs (Mac17,2 / Mac17,4 / Mac17,8; T8142 and T6050) in a managed fleet. 34 panic logs collected 30 Sept – 9 Oct, all with the same signature:
panic(cpu N caller ...): Kernel tag check fault (expected tagged address: 0x...028), esr 0x96000011
Faulting address is always at offset 0x28 of the object
Same crash PC per build: kernel text exec base + 0x48da38 on 27.0/27.0.1, + 0x46a784 on 26.7, + 0x466ee0 on 26.5
Panicked task is "Google Chrome Helper" in all 34 cases, thread Chrome_ChildIOThread (Chrome's IPC/network I/O thread)
Always 3–60 s after wake from sleep, usually a dark wake with the lid closed (overnight or after a 3–18 min sleep)
No third-party kexts loaded; "Post-boot loaded kexts" lists only Apple drivers
Affected builds: 26.5 (25F71), 26.7 (25G229), 27.0 (26A428), 27.0.1 (26A434). Not a regression from one update: a machine still on 26.5 panics identically.
Only Mac17-family hardware is affected. Older Apple silicon Macs with the same software stack are fine.
Present on every affected machine:
Chrome PWAs (Gmail/Chat/Meet) running in the background, keeping Chrome's network service alive across sleep. On one machine Microsoft Edge is the primary browser and never panics; only Chrome Helper does.
Microsoft Defender for Endpoint with its network filter (content filter) extension, MDM-managed.
This looks related to thread 821372, where DTS described a kernel networking panic on M5-family hardware with a Network Extension present (r.172793638 / FB22401652), fixed in 26.5b2. We appear to be seeing a tag-check-fault variant on 26.5 release and later.
Questions:
Is this a known issue, and is it the same root cause as r.172793638?
Is there a build where it's fixed?
Any recommended mitigation beyond preventing sleep and quitting Chrome?
Feedback Assistant: FB25128015 with panic logs and sysdiagnose. Happy to collect more data or test a build.
Backtrace from a 27.0.1 panic (kernel text exec base 0xfffffe003aa54000), panic PC first:
lr: 0xfffffe003aee1a38
lr: 0xfffffe003aeec580
lr: 0xfffffe003b12cf34
lr: 0xfffffe003b12dc50
lr: 0xfffffe003b07b1f8
lr: 0xfffffe003b07c758
lr: 0xfffffe003b237ff4
lr: 0xfffffe003ac787f0
lr: 0xfffffe003aa576ac
lr: 0x000000018747a57c (userspace)
3
0
288