Describe the bug

macOS kernel panicked while OrbStack was running. The panicked thread was an OrbStack Helper vCPU thread.

panic(cpu 1 caller 0xfffffe004897b450): [kalloc.type1.768]: element modified after free (off:632, val:0x0400000000000000, sz:768, ptr:0xfffffe2e9f3efa00)
Panicked task 0xfffffe187d72b960: 99830 pages, 76 threads: pid 1022: OrbStack Helper
Panicked thread: tid 10793, name "vcpu2"
Kernel Extensions in backtrace:
   com.apple.iokit.EndpointSecurity(1.0)[BFE3F049-1BF8-33A9-A0AB-3296A472C851]
      dependency: com.apple.driver.AppleMobileFileIntegrity(1.0.5)
      dependency: com.apple.security.quarantine(4)

This is most likely a macOS kernel bug (zone use-after-free detected while the vCPU thread was in a syscall going through EndpointSecurity), but since the
trigger was OrbStack's vCPU thread, I'm reporting it here in case others see the same signature or there's a known workaround.

Already reported to Apple: FB25509822.

No third-party EndpointSecurity clients or kexts installed (only Tailscale network extension and Karabiner DriverKit). Memory pressure was normal at panic
time.

To Reproduce

Not deterministic. Happened once during normal use:

1. OrbStack running the Docker machine with ~9 containers (Go backend, Postgres, Caddy, Node frontend, Gotenberg, OpenVPN/GlobalProtect client containers).
2. Sustained CPU load on the VM (one container using ~30-50% CPU continuously).
3. After several hours, the host kernel panicked and the Mac rebooted.

Expected behavior

No host kernel panic.

Diagnostic report (REQUIRED)

OrbStack info:
Version: 2.2.5
Commit: bf842321f95fc3ca7cda3227bf0cd41cb188c471 (v2.2.5)

System info:
macOS: 26.7.3 (25G342)
CPU: arm64, 12 cores
CPU model: Apple M4 Pro
Model: Mac16,11
Memory: 24 GiB

Full report: https://orbstack.dev/_admin/diag/orbstack-diagreport_2026-11-10T03-27-56.866419Z.zip

Screenshots and additional context (optional)

No response