IMPORTANT PSA about Lilu user-space patching kexts such as RestrictEvents

[VisualEhrmanntraut]

Relaying information from the ChefKiss Telegram supergroup. Previously discovered on January.

I noticed app crashes and system instability on my testing machine and many other Hackintoshes. Especially heightened on newer macOS versions such as Ventura and Sequoia.

And I found the cause. It is caused by the user-space patching. And unfortunately, without a more complicated/sophisticated and improved patching system, it is not possible to fix.

After disabling all kexts that do user-space patching, I noticed a significant speedup and improved stability.

It seems like macOS hates that the file contents in memory have been modified.

It is also the cause of those sporadic APFS "Volume Hash Mismatch" notifications. And the cause of software updates not installing (not not appearing).

A non-exhaustive list of kexts that do user-space patches: RestrictEvents, BlueToolFixup, FeatureUnlock, NoTouchID, IMKLPatcher, BFixup.

It is advised that you avoid them altogether, but if you have no choice, attempt to at least minimise or disable their user-space patches. For example, to retain only RestrictEvents' fix for the software updates, use revpatch=sbvmm.

---

Sidenote: if you enjoy the work I do, please consider supporting me on ko-fi so I can continue doing it: https://ko-fi.com/chefkiss. Any amount helps.

[joevt]

I wonder if the user patches in my Lilu/WhateverGreen forks have this issue?

1. cdf
   Patches one of these (depends on macOS version):
   /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
/System/Library/Frameworks/CoreDisplay.framework/Versions/A/CoreDisplay
   for the WindowServer process which can be found at one of these locations (depends on macOS version):
   /S*/L*/F*/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources
/S*/L*/F*/CoreGraphics.framework/Versions/A/Resources
/S*/L*/PrivateF*/SkyLight.framework/Versions/A/Resources

2. dpd
   It patches this:
   /usr/libexec/displaypolicyd

[VisualEhrmanntraut]

Sorry for the delayed response @joevt. Any user space patches cause this behaviour; it isn't specific to the content of the patches, rather, making modifications to the file contents in memory throws macOS off!