Beware a Full Recovery Partition
Little Snitch is the only third-party kernel extension that I use. I doubt that it’s the cause of the kernel panics I’ve been having, but I wanted to temporarily uninstall it just to be sure. I ran the uninstaller, which said it was successful, but the bundle identifier was still showing up in my kernel panic logs and in kextstat’s list of currently installed extensions. This was strange because I could see that the .kext file had indeed been deleted from the /System/Library/Extensions folder.
Even stranger, the logs showed version 2.5.1, when I’d had 2.5.2 installed for over a month. It seemed that Mac OS X’s kernel extension cache wasn’t being updated. I found various tips online, such as sudo touching the installed kernel extensions or removing the folder /System/Library/Caches/com.apple.kext.caches. None of these helped.
I then tried manually unloading the kernel extension:
icarus$ sudo kextunload -v -b at.obdev.nke.LittleSnitch (kernel) Can't remove kext at.obdev.nke.LittleSnitch; services failed to terminate - 0xe00002c7. Failed to unload at.obdev.nke.LittleSnitch - (iokit/common) unsupported function. Jun 21 10:37:46 icarus com.apple.kextcache[92]: Error copying //System/Library/Caches/com.apple.corestorage/EncryptedRoot.plist.wipekey to /Volumes/Recovery HD/com.apple.boot.R/System/Library/Caches/com.apple.corestorage/EncryptedRoot.plist.wipekey Jun 21 10:37:46 icarus com.apple.kextcache[92]: ucopyRPS - Error copying files used by the booter. errno 28 No space left on device
The error shows that the OS was trying to copy to the “Recovery HD” partition for Lion Recovery, but the partition was full. Apparently it was aborting without updating the cache on my main partition (which was not full). I used diskutil to mount the “Recovery HD” partition, and sure enough it only had about 40KB free.
Live-resizing the partitions didn’t seem to be possible, so I reformatted my drive and reinstalled Lion, which created a fresh recovery partition (now called “Boot OS X”, for some reason), which has 128 MB free. Now there’s enough space for the system to automatically update the kernel extension cache.
Sidenote: While trying to free up some space on the recovery partition, to avoid having to repartition, I inadvertently messed something up and rendered the main partition unbootable. Since there doesn’t seem to be a convenient way to create a new recovery partition, it’s probably a good idea to keep a backup. I’m going to create a device image of mine using DropDMG. I also learned that Carbon Copy Cloner can do this automatically when backing up the main partition.
This might have helped:
http://derflounder.wordpress.com/2011/10/22/removing-and-rebuilding-a-malfunctioning-recover-hd-partition/
I've done it recently, works perfectly. Only caveat - if you're using a Mac released after the Lion Recovery Update, you likely have a newer version of the Recovery Partition. In that case, I'd reinstall instead.