What you will achieve

Recognise kernel panics, capture useful logs, and narrow hardware vs software causes.

Kernel panic is macOS equivalent of Blue Screen — full stop with auto reboot. Logs in DiagnosticReports identify offending kexts or drivers. Distinguish panic from app quit or sleep failure — panics need log preservation before retry loops erase evidence.

1) What a panic looks like

Full-screen restart message in multiple languages — Mac rebooted because something corrupted the kernel. Differs from app crash or beachball.

2) Find panic reports

Finder → Go → Go to Folder → /Library/Logs/DiagnosticReports/
Look for panic-full-*.ips sorted by date.
Or Console.app → Crash Reports.

3) Read the log

Search for panic(cpu and kernel extensions in backtrace — third-party kexts (VPN, antivirus, audio) often named. Note timestamp to correlate with action.

4) Common triggers

Recently added RAM (Intel) or aftermarket NVMe (hackintosh).
Failing SSD — run Disk Utility First Aid.
macOS beta + old drivers.

5) Next steps

Remove suspect kexts; boot Safe Mode; update macOS; run Apple Diagnostics (D at Intel startup; power hold → Options → Diagnostics on Apple Silicon). Repeat panics on clean install → hardware service.

6) Panic string keywords

watchdog timeout often GPU or storage hang; zonemap exhaustion memory driver bug; bridge OS Apple Silicon firmware layer — note exact string for search.

7) Third-party RAM (Intel)

Non-Apple RAM causing panics — test one module at a time in safe configuration. Apple Silicon RAM is soldered — panics point to logic board or software.

8) Reporting to Apple

Analytics sends panic automatically if enabled — you can also upload sysdiagnose after reproducible panic with Feedback Assistant.

Verify

No new panic-full files after fix; stable uptime 48+ hours under normal load.

Additional troubleshooting notes

If steps above do not resolve the issue on the first attempt, reboot once, confirm System Settings → General → Software Update is current, and retry with a second administrator account to rule out profile or keychain corruption in your daily user. Document exact error text from Console.app with timestamp — vague “it still fails” without logs wastes support time. On Apple Silicon, re-test after full shutdown (not just restart) because firmware and Thunderbolt controllers reset only on cold boot. Intel Macs should repeat test in Safe Mode to bypass third-party login items. Before erase or keychain reset, verify Time Machine or clone backup completed — batch 3 guides assume Monterey/Ventura/Sonoma/Sequoia paths in System Settings; search Spotlight for renamed panes if your macOS version labels differ slightly.