Kernel panic on macOS: leaked retain on IOMediaBSDClient after dismounting an encrypted partition prevents device termination

[AcademyITDMS]

Environment

• MacBook Air 15" (Apple M4, ARM64, T8132)
• macOS 26.6.2 (build 25G83), Darwin 25.6.0
• VeraCrypt 1.26.29
• FUSE backend: <FUSE-T.>
• Volume: external 14 TB USB HDD, whole-partition encryption
  (GPT: Microsoft Reserved + Microsoft Basic Data)
• No third-party kernel extensions loaded (verified with kmutil),
  SIP enabled, full boot security

Summary

On dismount, VeraCrypt does not release a retain it holds on the
IOMediaBSDClient object of the underlying encrypted partition. The
object stays over-retained. When the physical device is later removed,
that object cannot finish termination and remains stuck in
inactive, busy 1 indefinitely. The next system sleep triggers a
60-second IOKit busy timeout and the machine panics.

This is specific to laptops, where sleep/wake happens routinely
(closing the lid). On a desktop that never sleeps the leak would stay
invisible.

Steps to reproduce

1. Reboot. Connect the external drive, do not mount anything.
2. Mount the encrypted partition in VeraCrypt.
3. Dismount it in VeraCrypt (not via Finder). Optionally quit
   VeraCrypt entirely — makes no difference.
4. Power the drive off (or unplug it).
5. Close the lid for 5–10 minutes, then open it.
6. Kernel panic within ~2 minutes of wake.

Evidence

Output of ioreg -c IOMediaBSDClient -r -w0 | grep -i IOMediaBSDClient
at each stage (external drive objects only):

• After reboot, drive off: 5 objects (internal disks), all busy 0
• Drive powered on, nothing mounted: 3 new objects appear
  (whole disk + 2 partitions), all active, busy 0, retain 6
• Volume mounted in VeraCrypt: 1 more object appears (the decrypted
  volume), AND the encrypted partition's object goes retain 6 -> 7
• Dismounted in VeraCrypt: the decrypted volume object is gone
  (clean), but the encrypted partition's object still shows retain 7
• Drive powered off: the other two objects terminate cleanly and
  disappear; the encrypted partition's object remains:

+-o IOMediaBSDClient <class IOMediaBSDClient, id 0x1000013f9,
!registered, !matched, inactive, busy 1 (9383 ms), retain 7>

The busy timer keeps counting indefinitely (observed past 264000 ms).
diskutil eject on that disk fails. lsof on /dev/diskN and
/dev/rdiskN returns nothing, so this is a kernel-level retain, not an
open file descriptor. Only a reboot clears it.

Resulting panic

panic(cpu 0 caller 0x...): busy timeout[1], (60s):
'IOMediaBSDClient' (1,1812001) @IOService.cpp:5986
Panicked task ... pid 541: watchdogd

What was ruled out

• Machine and OS: a session with no external drive sleeps and wakes
  normally, repeatedly
• The drive and its enclosure: powering it on and off without ever
  mounting the volume causes no leak and no panic
• Third-party kernel extensions: none are loaded
• Dismount order: same result whether dismounted via Finder first or
  in VeraCrypt only
• Quitting the application: does not release the retain

The leak occurs at dismount, before the device is removed. The extra
retain is taken at mount time and never returned.

Workaround

Leaving the drive powered on after dismount avoids the panic entirely:
sleep and wake work normally. The panic only occurs if the device is
removed after a mount/dismount cycle.