[Bug] Kernel panic (zone map exhaustion / memory leak) via EndpointSecurity — opencode.exe

[shiyan-salt]

Summary

A kernel panic occurred on 2026-06-12 caused by opencode exhausting the macOS kernel zone map through an apparent memory leak in the data.kalloc.1024 zone, triggered via the EndpointSecurity kext.

Environment

Field	Value
OS	macOS 26.3 (25D125)
Kernel	Darwin 25.3.0 — xnu-12377.81.4~5/RELEASE_ARM64_T6000
Chip	Apple M1 Pro (T6000)
Date/Time	2026-06-12 14:37:57 +0800
Panicked process	opencode.exe (PID 33091)

Panic String

panic(cpu 2 caller 0xfffffe0029931d58): zalloc[3]: zone map exhausted while
allocating from zone [data.kalloc.1024], likely due to memory leak in zone
[data.kalloc.1024] (20G, 21182160 elements allocated) @zalloc.c:4534

Largest Zones at Time of Crash

Zone	Size	Free
data.kalloc.1024	20 GB	0 B
APFS_INODES	106 MB	211 KB
compressor_segment	60 MB	14 MB

The data.kalloc.1024 zone consumed the entire zone map (20 GB, 21,182,160 elements) with zero bytes remaining.

Backtrace (Panicked Thread tid 22229811)

Panicked task 0xfffffe2e9f38eb70: 31766 pages, 29 threads: pid 33091: opencode.exe
Panicked thread: 0xfffffe1d3b075fc0, backtrace: 0xfffffecc1c4dad30, tid: 22229811

  lr: 0xfffffe00298adcf0  fp: 0xfffffecc1c4dadc0
  lr: 0xfffffe0029a1e60c  fp: 0xfffffecc1c4dae30
  lr: 0xfffffe0029a1c804  fp: 0xfffffecc1c4daef0
  lr: 0xfffffe0029853b88  fp: 0xfffffecc1c4daf00
  lr: 0xfffffe00298adfbc  fp: 0xfffffecc1c4db3e0
  lr: 0xfffffe002a1b5854  fp: 0xfffffecc1c4db400
  lr: 0xfffffe0029931d58  fp: 0xfffffecc1c4db600   ← zalloc panic site
  lr: 0xfffffe00299357f8  fp: 0xfffffecc1c4db680
  lr: 0xfffffe0029aa8fcc  fp: 0xfffffecc1c4db960
  lr: 0xfffffe0029acdcdc  fp: 0xfffffecc1c4db9b0
  lr: 0xfffffe002b9e3138  fp: 0xfffffecc1c4dba30   ← EndpointSecurity entry
  lr: 0xfffffe002ba12808  fp: 0xfffffecc1c4dbb60
  lr: 0xfffffe002ba12b18  fp: 0xfffffecc1c4dbb80
  lr: 0xfffffe002a194b68  fp: 0xfffffecc1c4dbbe0
  lr: 0xfffffe0029afb3c0  fp: 0xfffffecc1c4dbc30
  lr: 0xfffffe0029ae6a3c  fp: 0xfffffecc1c4dbde0
  lr: 0xfffffe0029faf504  fp: 0xfffffecc1c4dbe50
  lr: 0xfffffe0029a1c88c  fp: 0xfffffecc1c4dbf10
  lr: 0xfffffe0029853b88  fp: 0xfffffecc1c4dbf20
  lr: 0x000000018d41483c  fp: 0x0000000000000000

Kernel Extensions in backtrace:
  com.apple.iokit.EndpointSecurity(1.0)[63D37344-1EF0-3E77-95AC-44E720AEBA86]
    @ 0xfffffe002b9d6a80 -> 0xfffffe002ba65823

Analysis

The panic trace goes through com.apple.iokit.EndpointSecurity, the macOS security event framework used for monitoring filesystem and process events. opencode appears to be subscribing to EndpointSecurity events in a way that causes the kernel to allocate kalloc.1024 objects without ever releasing them — 21 million allocations over the session, consuming 20 GB of kernel zone map space, ultimately causing the machine to hard-panic and reboot.

Hypothesis: opencode's file-watching / process-monitoring code registers EndpointSecurity event handlers but leaks the associated kernel objects (possibly es_message_t buffers or related notification structures) over time. Under sustained use, this compounds until zone exhaustion.

Steps to Reproduce

1. Run opencode for an extended session (exact duration unknown — crash occurred mid-session)
2. Kernel panic occurs without warning; machine reboots

Impact

• Severity: Critical — causes a hard kernel panic and forced reboot, losing all unsaved work
• Machine must be restarted; no graceful shutdown

Diagnostic Files

• Full panic log: /Library/Logs/DiagnosticReports/panic-full-2026-06-12-143757.0002.panic (2.4 MB)
• Reset counter diag: /Library/Logs/DiagnosticReports/ResetCounter-2026-06-12-143801.diag
• Boot faults recorded: wdog, reset_in1
• Incident ID: FB6F2EC5-E99D-45FC-984B-EE99D8B27889

Suggested Fix

Audit all EndpointSecurity client usage for missing es_release_message() / es_delete_client() calls. Ensure that every es_message_t received via the event handler block is released after processing, and that the ES client is properly torn down on shutdown.

[huashiyiqike]

Confirming the same pattern here with opencode 1.16.0 + oh-my-openagent on macOS 26.5.1 (25F80).

Running alongside Claude Code (which has a similar open issue at anthopics/claude-code#66020 -- also EndpointSecurity-triggered kalloc.1024 leak). The two tools together appear to叠加 the leak rate, causing panics every 9-23 hours instead of days.

Observed panic signature:

• data.kalloc.1024 exhausts to exactly 20GB (~21M elements) every time
• Panicked task: bash (via AMFI backtrace)
• 8 identical panics over 5 days

May be worth checking if the file-watching / EndpointSecurity subscription pattern in oh-my-openagent differs from standard opencode usage, since the leak rate seems to scale sharply with active agent count.

Available to provide panic logs or test any workaround builds.

[SamuelSmeys]

Experiencing the same issue under the same circumstances (Multi day sessions) - was going to open an issue but found this one (pasting below)

Please let me know if you need anything else

---

Hello,

Recently I've had multiple full PC restarts occur while using Opencode for an extended amount of time.

Panicked task 0xfbfffe2735a40e28: 162143 pages, 40 threads: pid 95484: opencode.exe

Opencode v1.17.9

Device: MacBook Pro (16in)
CPU: M5 Max
RAM: 128GB (unified)
GPU: 40 Core version
OS: 26.5.1 (25F80) - Tahoe
Arch: ARM (Apple Silicon)

Additional Info:

• Heavy build / compile commands seem to be running when it seems to crash (typescript's tsc; a heavy tsup build). I'm running turborepo.
• The sessions are quite long (multi day sessions with many compacts)
• Can't ascertain whether this is opencode or a tsc issue
• Running Opencode in Wezterm

Backtrace below

panic(cpu 17 caller 0xfffffe0046f3434c): zalloc[3]: zone map exhausted while allocating from zone [data.kalloc.1024], likely due to memory leak in zone [data.kalloc.1024] (20G, 21314176 elements allocated) @zalloc.c:4575
Debugger message: panic
Memory ID: 0xff
OS release type: User
OS version: 25F80
Kernel version: Darwin Kernel Version 25.5.0: Mon Apr 27 20:41:12 PDT 2026; root:xnu-12377.121.6~2/RELEASE_ARM64_T6050
Exclaves boot status: BOOTED_EXCLAVEKIT
Fileset Kernelcache UUID: FA2FED67B2169BE3D07C44D1417FAEF4
Kernel UUID: FF5FFF89-5F93-3D5F-A4FB-74B8C8C313AC
Boot session UUID: A108FB66-722C-4AC7-85F2-1BEF0C3802CB
iBoot version: mBoot-18000.120.36
iBoot Stage 2 version: mBoot-18000.120.36
secure boot?: YES
roots installed: 0
Paniclog version: 15
Debug Header address: 0xfffffe0022afd000
Debug Header entry count: 3
TXM load address: 0xfffffe0032a58000
TXM UUID: F0C1A57F-CE44-3DF4-9E86-0CFF02D7C00D
Debug Header kernelcache load address: 0xfffffe0042a58000
Debug Header kernelcache UUID: FA2FED67-B216-9BE3-D07C-44D1417FAEF4
SPTM load address: 0xfffffe0022a58000
SPTM UUID: 8DD65C9D-2AA5-38D6-9CA3-86CE9A386FC3
KernelCache slide: 0x000000003ba54000
KernelCache base:  0xfffffe0042a58000
Kernel slide:      0x000000003ba5c000
Kernel text base:  0xfffffe0042a60000
Kernel text exec slide: 0x000000003fe2c000
Kernel text exec base:  0xfffffe0046e30000
mach_absolute_time: 0x24e92d6936a
Epoch Time:        sec       usec
  Boot    : 0x6a3455b6 0x000c86a5
  Sleep   : 0x6a37ae83 0x000022ce
  Wake    : 0x6a37af4d 0x000c9f0c
  Calendar: 0x6a3819c6 0x0008c1c7

Zone info:
  Zone map: 0xfffffe1330000000 - 0xfffffe3930000000
  . VM    : 0xfffffe1330000000 - 0xfffffe18fc000000
  . RO    : 0xfffffe18fc000000 - 0xfffffe1b96000000
  . GEN0  : 0xfffffe1b96000000 - 0xfffffe2162000000
  . GEN1  : 0xfffffe2162000000 - 0xfffffe272e000000
  . GEN2  : 0xfffffe272e000000 - 0xfffffe2cfa000000
  . GEN3  : 0xfffffe2cfa000000 - 0xfffffe32c6000000
  . DATA  : 0xfffffe32c6000000 - 0xfffffe3930000000
  Metadata: 0xfffffe3a30010000 - 0xfffffe3a39810000
  Bitmaps : 0xfffffe3a39810000 - 0xfffffe3a49810000
  Extra   : 0 - 0

CORE 0 [MACC0] recently retired instr at 0x0000000000000000
CORE 1 [MACC0] recently retired instr at 0x0000000000000000
CORE 2 [MACC0] recently retired instr at 0x0000000000000000
CORE 3 [MACC0] recently retired instr at 0x0000000000000000
CORE 4 [MACC0] recently retired instr at 0x0000000000000000
CORE 5 [MACC0] recently retired instr at 0x0000000000000000
CORE 6 [MACC1] recently retired instr at 0x0000000000000000
CORE 7 [MACC1] recently retired instr at 0x0000000000000000
CORE 8 [MACC1] recently retired instr at 0x0000000000000000
CORE 9 [MACC1] recently retired instr at 0x0000000000000000
CORE 10 [MACC1] recently retired instr at 0x0000000000000000
CORE 11 [MACC1] recently retired instr at 0x0000000000000000
CORE 12 [PACC2] recently retired instr at 0x0000000000000000
CORE 13 [PACC2] recently retired instr at 0x0000000000000000
CORE 14 [PACC2] recently retired instr at 0x0000000000000000
CORE 15 [PACC2] recently retired instr at 0x0000000000000000
CORE 16 [PACC2] recently retired instr at 0x0000000000000000
CORE 17 [PACC2] recently retired instr at 0x0000000000000000
TPIDRx_ELy = {1: 0xfefffe27325d4ac0  0: 0x0000000000002011  0ro: 0x0000000415c7b0e0 }
CORE 0: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecffa91bee0
CORE 1: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecffb0ebee0
CORE 2: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecffaaebee0
CORE 3: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecff996bee0
CORE 4: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecffb2cbee0
CORE 5: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffe992a43fee0
CORE 6: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecffa24bee0
CORE 7: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecffb2bbee0
CORE 8: PC=0xfffffe0046ef0b70, LR=0xfffffe0046ef0b6c, FP=0xfffffecffd5dbee0
CORE 9: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecffb9abee0
CORE 10: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecffc1bbee0
CORE 11: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecff9f7bee0
CORE 12: PC=0xfffffe0046ef0b70, LR=0xfffffe0046ef0b6c, FP=0xfffffecffa4ebee0
CORE 13: PC=0x000000010756a32c, LR=0x00000001072aab64, FP=0x000000016b6aab10
CORE 14: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecffb9ebee0
CORE 15: PC=0x0000000169ec2220, LR=0x0000000169ec20a8, FP=0x0000000421b60ba0
CORE 16: PC=0xfffffe0046ef0b6c, LR=0xfffffe0046ef0b6c, FP=0xfffffecffd3dbee0
CORE 17 is the one that panicked. Check the full backtrace for details.
Compressor Info: 0% of compressed pages limit (OK) and 0% of segments limit (OK) with 0 swapfiles and OK swap space
Panicked task 0xfbfffe2735a40e28: 162143 pages, 40 threads: pid 95484: opencode.exe
Panicked thread: 0xfefffe27325d4ac0, backtrace: 0xfffffecffd2bae10, tid: 3461867
		  lr: 0xfffffe0046e883e8  fp: 0xfffffecffd2baeb0
		  lr: 0xfffffe0047040ec8  fp: 0xfffffecffd2baf20
		  lr: 0xfffffe004703e9c8  fp: 0xfffffecffd2bafe0
		  lr: 0xfffffe0046e35ee4  fp: 0xfffffecffd2baff0
		  lr: 0xfffffe0046e88730  fp: 0xfffffecffd2bb390
		  lr: 0xfffffe0046e87d28  fp: 0xfffffecffd2bb560
		  lr: 0xfffffe00477be780  fp: 0xfffffecffd2bb580
		  lr: 0xfffffe0046f3434c  fp: 0xfffffecffd2bb780
		  lr: 0xfffffe0046f37d60  fp: 0xfffffecffd2bb810
		  lr: 0xfffffe0046ec2d5c  fp: 0xfffffecffd2bb840
		  lr: 0xfffffe004764f4b4  fp: 0xfffffecffd2bb860
		  lr: 0xfffffe0044e5e48c  fp: 0xfffffecffd2bb8a0
		  lr: 0xfffffe0044e648a0  fp: 0xfffffecffd2bba80
		  lr: 0xfffffe00477a9b48  fp: 0xfffffecffd2bbb00
		  lr: 0xfffffe0047458460  fp: 0xfffffecffd2bbdf0
		  lr: 0xfffffe00475d371c  fp: 0xfffffecffd2bbe50
		  lr: 0xfffffe004703eaa4  fp: 0xfffffecffd2bbf10
		  lr: 0xfffffe0046e35ee4  fp: 0xfffffecffd2bbf20
		  lr: 0x000000018ca06a18  fp: 0x0000000000000000
      Kernel Extensions in backtrace:
         com.apple.driver.AppleMobileFileIntegrity(1.0.5)[015B9910-F0CE-3FA6-B068-2826DDD2F2AE]@0xfffffe0044e593b0->0xfffffe0044e8dd13
            dependency: com.apple.iokit.CoreAnalyticsFamily(1)[6C155845-E7E3-3A29-9A89-08733B218F51]@0xfffffe00455e1510->0xfffffe00455e9ee7
            dependency: com.apple.kec.corecrypto(26.0)[E32A8F10-1A9A-3F79-B28F-FCE426314EB6]@0xfffffe0046c2b200->0xfffffe0046c956ab
            dependency: com.apple.kext.CoreTrust(1)[2D65AD2B-D5DD-35DF-A6E5-7C2C225B3A7D]@0xfffffe0045697c30->0xfffffe00456a1d2f
            dependency: com.apple.security.AppleImage4(7.0.0)[B62B64D0-3165-305A-89BB-ECDE051931D0]@0xfffffe0044c4cfc0->0xfffffe0044c7105f


last started kext at 3065716013: com.apple.driver.usb.cdc.ncm	5.0.0 (addr 0xfffffe004318d180, size 5324)
loaded kexts: (skipped, see boot kernelcache)


** Exclaves panic stackshot not found

** Stackshot Succeeded ** Bytes Traced 1114222 (Uncompressed 2876960) **

[ech0potato]

Another data point for this issue — same kernel panic happened to me today.

Environment:

• macOS 26.3 (25D125)
• Darwin 25.3.0 — xnu-12377.81.4~5/RELEASE_ARM64_T6030
• Chip: Apple M4 Pro/Max (T6030)
• Panicked process: opencode.exe (PID 95337)

Panic string:

panic(cpu 10 caller 0xfffffe005361d9d0): zalloc[3]: zone map exhausted while
allocating from zone [data.kalloc.1024], likely due to memory leak in zone
[data.kalloc.1024] (19G, 20787632 elements allocated) @zalloc.c:4534

Largest zones at crash:

Zone	Size	Free
data.kalloc.1024	19 GB	0 B
data_shakalloc.3072	338 MB	96 K
APFS_4K_OBJS	160 MB	180 K

• 19 GB consumed in data.kalloc.1024, ~20.8 million elements
• Same EndpointSecurity signature in the backtrace (com.apple.iokit.EndpointSecurity)
• Session was a long-running one (multi-day, many compacts)

Symptoms, panic signature, and backtrace are identical to what's already reported here. Just adding another confirmation.

[markjaquith]

@ech0potato @SamuelSmeys @huashiyiqike @shiyan-salt Are any of you using security software like Crowdstrike Falcon? I believe these sorts of things hook into com.apple.iokit.EndpointSecurity

I'm also seeing these same kernel panics, correlated with OpenCode usage leveraging a lot of worktree creation in massive Git repos. Crowdstrike Falcon is currently my prime suspect, but I don't have a smoking gun.

[vv111y]

I hit this on July 11, 2026.

• OpenCode: 1.17.15
• Device: MacBook Pro 16-inch (Mac17,8)
• CPU: M5 Pro
• RAM: 64 GB unified memory
• OS: macOS Tahoe 26.5, build 25F71
• Architecture: Apple Silicon / ARM64

The panic signature was:

zone map exhausted while allocating from zone [data.kalloc.1024],
likely due to memory leak in zone [data.kalloc.1024]
(19G, 20067488 elements allocated)

Additional details:

Panicked task: pid 90088: opencode.exe
Compressor Info: 9% of compressed pages limit (OK)
Swap space: OK
Kernel Extensions in backtrace:
    com.apple.filesystems.apfs

The machine had been up for roughly 11 days. I was using OpenCode against a local rapid-mlx server running Qwen3.6-35B-A3B-8bit. The model context and KV cache had grown substantially, although the panic itself was kernel zone-map exhaustion rather than an ordinary process-memory or Metal OOM.

I am not running CrowdStrike Falcon or another enterprise EDR product. I do have LuLu and Tunnelblick installed, but neither appears in the panic backtrace.

I was not intentionally doing unusually heavy worktree creation, although I do not know whether OpenCode created or manipulated worktrees internally during the session.

I can attach the complete panic report if useful.

[qy1603429908]

Any workarounds? My little Mac Mini M4 16GB Ram gonna overwhelm...
PID COMMAND %CPU TIME #TH #WQ #PORT MEM PURG CMPRS PGRP PPID STATE BOOSTS %CPU_ME %CPU_OTHRS UID FAULTS COW
kernel_task 23.7 55:52:00 642/11 0 0 9200K 0B 0B 0 0 running 0[0] 0.00000 0.00000 0 1467592 0
24236
opencode 23.2 06:57:44 21 1 76 6105M+ 0B 5796M+ 24236 19983 sleeping *0[1] 0.00000 0.00000 501 275053228+ 653

[DimitarTachev]

I had the same issue with Claude Code; the root cause was the npm installation and updates without restarting the existing processes. More details:

anthropics/claude-code#66020 (comment)