My network connection is not unplugged: a KEXT, a MAC, and an almost dead Mac

Sunday was going to be busy. For the first time in years, I had two writing deadlines which coincided: by the end of the day (or night), I had a load of screenshots to take, prepare, and submit along with the almost completed text for two articles.

I made an early start, and thought it best to restart my iMac into its special screenshot user account which I keep preconfigured so that each shot meets the detailed editorial rules. But once restarted, this was no longer my iMac. In fact, it was barely an iMac at all. It was now completely disconnected from the network and Internet, complaining that its wired Ethernet was unplugged.

Even after all these years interpreting error messages, I believed what it told me. Sometimes, when we are asleep in bed, our cat roams the odd nooks and crannies in our house, and could easily have dislodged a cable. Although it had been working just a minute ago, I had to spend some time proving that there was electrical connectivity from the back of the iMac to the network and modem-router.

I then checked for the MAC address of the Ethernet port: there was none, so I turned AirPort on to at least re-establish connections with the outside world. My Mac was no longer completely crippled, just largely so. It turns out that losing the MAC address on that port made OS X and the App Store think that this was a different Mac altogether, and almost all my purchased apps were now broken.

When you try to launch an app purchased from the App Store, it and OS X run a quick security check to see whether that Mac and its associated Apple ID are authorised to operate. One of the key pieces of hardware information which is factored into this is the Mac’s Ethernet MAC. When that suddenly vanishes, this authentication mechanism breaks. The App Store thinks it is a different Mac, but could not cope with the fact that some of it was the same as my old system.

At this stage, I was beginning to wonder if the App Store was having a bit of a crisis too. Each time that I tried to run an app purchased there, I was informed that I was running it for the first time, and asked to sign in with my Apple ID password. Each time it thought for a moment, then told me that an unknown error had occurred, and advised me to contact support. This was worryingly like the last time that Apple’s security certificate was changed, last autumn, and I knew that another change was occurring this month.

My only option was to press ahead and capture as many screenshots on the iMac as I could, then fall back to getting the rest on my MacBook Air later, which would (if the App Store was not awry) at least let me run my purchases.

I was worried, though, why my Ethernet port had suddenly vanished. From my recollection of this iMac’s logic board, a hardware failure would almost certainly require a replacement. That would mean traipsing over to West Quay in Southampton, which would take up most of a morning, or hanging around waiting for a courier to collect it for shipping to a repair centre. Then the iMac would be away for a week or so, its Fusion Drive would be re-initialised…

In an effort to console myself that it was something simpler, I ran Apple Diagnostics, which told me that the hardware checked out correctly. By this stage I was not convinced: my last iMac had passed even the extended hardware check when its graphics adaptor was broken, which hardly encouraged me to place confidence in that test result.

I browsed back through the logs to see if there were any clues there. Sure enough, a few dozen entries after its last restart – my iMac had been restarted plentifully by now – there were a couple of lines which reported that the major kernel extension (KEXT) responsible for supporting its Ethernet port had not been found.

Back in Yosemite and earlier, I could then simply (relatively) locate the last working copy of that extension, pop it back into the /System/Library/Extensions folder, restart, and away we’d go. But now with SIP, trying that sort of trick is almost certain to fail, and my problems could have been amplified. The only way to fix that now would be to re-install OS X. Besides, if that one extension had vanished, who knows what else was missing or damaged?

In between all this, I plodded on as best I could getting my screenshots, updating my MacBook Air from 10.11.2 to 10.11.3, installing the additional apps which I needed on it, and pulling across copies of my major working folders to the MacBook Air in case the Ethernet port problem started to take out other areas of my iMac’s logic board.

We also had a fairly busy Sunday schedule which took me out of the house for much of the morning and afternoon. Just to be safe, I shut the iMac down and left it, vainly hoping that when it was started up again, the problems would vanish as magically as they came. But that was not to be.

I finally bundled up my two articles and got them emailed before 2330. I was pretty tired by then, having started work at 0515 that morning, but happy that I had met my deadlines, and with a couple of minor issues, they were out of the door.

That gave me a little time to start on my strategy for the morning.

If my missing Ethernet port was a hardware problem, there was nothing more that I could do other than call on AppleCare. If, however, it was due to a missing kernel extension, then I would need to replace that. Although that might take a full re-install of OS X, there was a potentially much quicker and cleaner solution: download and install the OS X 10.11.3 Combo updater from here.

Apple used to provide Combo updaters for each OS X update (apart from the first in each major release, e.g. 10.6.1) but had lately driven us to use the App Store, Recovery mode, and full re-installation. When Combo updaters were provided, they often proved an excellent panacea for a wide range of problems. There were few issues of MacUser which did not, in my Q&A section, include the recommendation to download and install the latest Combo updater, and they sorted out all manner of weird issues.

As I had chewed over my recovery plan at various times during Sunday, I decided that once I had got my articles away, I would follow my own much-repeated wisdom. As it was, I went to bed just after midnight with the 1.75 GB Combo updater being downloaded. First thing this morning, I mounted the disk image, ran the installer, and finished washing and dressing.

By the time that I came back down, my iMac was prompting me to log on. Once I did, everything was back to normal: my wired network connection was back up and running, all my apps worked, the sun was out and it is a fine day again.

So, what did I learn from this twenty-four hour nightmare?

  • Never take an error message at face value, as it may well mislead you into a wild goose chase.
  • Check faults and failures systematically.
  • One missing kernel extension can cripple El Capitan.
  • SIP provides little or no protection against damaged or missing kernel extensions, even though they are in a ‘protected’ folder.
  • Combo updaters are panaceas which can get you out of seemingly very deep holes.
  • Recovery mode is not the only path to recovery.
  • El Capitan has very poor fault tolerance.
  • When problems strike, always check your logs.

I am very glad that I was not trying to solve this one by email.