[Bug]: Tahoe installer can't create or mount APFS on internal SSD (AppleKeyStore "sys bound vek" error), MacBook Air 2018
bug
Mac model / Mac-Modell
T2 — MacBook Air 2018
Target macOS version (if it is about malicious forks, typosquatting sites or security vulnerabilities, write - instead) / macOS-Zielversion (falls es um Typpfehler-Webseiten, Typpfehler-Repository oder Sicherheitslücken handelt, schreiben Sie stattdessen ein - )
macOS 26.7.1 Tahoe
OpenCore Legacy Patcher T2 version (Please state the version clearly, not state as version new or something. / Bitte die exakte Version nennen, nicht nur etwas oder neu.)
4.0.0.190009.9
Issue type or recommendation / Typ Fehler oder Empfehlung
Installer error / Installationsfehler
Description / Beschreibung
APFS doesn't work in the Tahoe installer on the internal SSD of my MacBook Air 2018. The installer boots fine, but formatting the internal drive as APFS fails with "-69832: File system formatter failed" in Disk Utility, and pre-formatted APFS volumes show up in the list but don't mount.
From Terminal it's the same thing:
newfs_apfs -v Test /dev/disk0s2
newfs_apfs: unable to format volume inside /dev/disk0s2: Invalid argument
Steps: boot the installer made by the patcher, open Terminal, run diskutil partitionDisk /dev/disk0 GPT APFS "Test" 0 (or erase the drive as APFS in Disk Utility). Expected: it gets formatted and mounts. Actual: it fails as above.
dmesg right after the failure is in the logs field below. The short version: APFS fails when AppleKeyStore is asked to create the system bound volume key on the internal SSD (err 0xe00002c2).
What works: HFS+ formats and mounts fine on the internal drive, APFS inside a disk image works (the installer's own base system is one), and Internet Recovery formats the same drive as APFS without problems.
What didn't change anything (same error every time): booting as the real MacBookAir8,1 or as the spoofed MacBookPro16,4, and adding aks-endpoint=0 acm_panic_on_sep_response_timeout=0 TSC_sync_margin=0 to the boot-args by hand (those are from the latest commit, they're not in the release). The Force FileVault patch isn't in this build's config either.
This is a follow up to #574. Still willing to test builds or changes.
This might be related to #533 (MacBookPro15,1, can't erase or create partitions in the installer), but I don't know that yet.
Steps to upload the logs of the kernel panic if any (if not, you can skip this step or write -) / Schritte zum Hochladen der Protokolle des Kernel-Panics, falls vorhanden (falls keiner, dann Sie können das überspringen oder einen - schreiben)
Panic log (if any) / additional notes (if any) / Panikprotokoll (falls einer) / zusätzliche Notizen (falls einer)
dmesg after newfs_apfs fails:
apfs_keybag_set_create_update_record:4457: failed to commit new sys bound vek, err = 0xe00002c2
apfs_meta_crypto_state_init:1485: unable to create KEK/VEK in apfs volume keybag (22)
apfs_newfs:32343: disk4s1 unable to create/store metadata crypto (22)
apfs_newfs:32690: disk4 fs creation failed: 22 ... cleaning up...
EFFACER_service:14135: disk4 Container has (eff = 4294968120, aks = 0)
kextstat (loaded in the installer):
com.apple.kpi.dsep 25.6.0
com.apple.driver.AppleSEPManager 1.0.1
com.apple.driver.AppleCredentialManager 1.0
com.apple.driver.AppleFDEKeyStore 28.30
com.apple.driver.AppleKeyStore 2
as.vit9696.Lilu 1.7.2
org.t2tahoefixup.T2TahoeFixup 1.0.2
com.apple.filesystems.apfs 2811.160.7
boot-args:
keepsyms=1 debug=0x100 -ibtcompatbeta ipc_control_port_options=0 -v nvme_shutdown_timestamp=0 igfxgl=1 igfxmetal=1 -disable_sidecar_mac -disable_media_analysis -amfipassbeta igfxonln=1 igfxfw=2 forceRenderStandby=0 agdpmod=vit9696 rddelay=10 -disable_ext_panics -no_compat_check AMFIPass=0x1 amfi=0x80 -oas_skip_attestation