macOS 10.13.6 Supplemental Update 2: Hackintosh USB Panics and Fixes

The macOS 10.13.6 Supplemental Update 2, released in October 2018, introduced a subtle change to the XHCI driver stack that caused immediate kernel panics on several Z170-based Hackintosh builds. Unlike the earlier Supplemental Update 1, which addressed only a Time Machine encryption bug, Update 2 quietly revised the AppleUSBXHCI.kext and the associated IOUSBHostFamily.kext. For builders running Clover r4515 or earlier, the result was a panic at AppleUSBXHCIPCI::start before the login window appeared. Here's what changed, which hardware got hit, and how to apply the update without losing your working configuration.

What Changed in Update 2

The official release notes from Apple mentioned only “improved reliability for USB devices.” In practice, the update replaced the USB port limit patch logic. Earlier versions of macOS 10.13.6 allowed up to 15 ports per controller, matching the Intel EHCI/XHCI specification. Update 2 reduced the effective limit on some third-party USB 3.0 controllers (especially ASMedia and VIA) to 10 ports, and changed the internal port-to-connector mapping for the X99 and C612 chipset families. Users on Haswell-E and Broadwell-E platforms reported that front-panel USB 3.0 ports stopped enumerating after the update, even with port-limit-inject patches in Clover.

The second major change involved the AppleGraphicsControl.kext. Update 2 added a new check for the GPU VBIOS version string. On systems with NVIDIA Kepler cards (GTX 680, GTX 780 Ti) that used an unmodified reference VBIOS, the system would boot to a black screen after the update unless the nvda_drv=1 boot flag was explicitly set and the Nvidia Web Driver (version 387.10.10.10.40.130) was reinstalled. This was not a regression in the Web Driver itself, but a stricter VBIOS validation that caused the driver to skip initialization on certain OEM cards.

Kext Compatibility Matrix

Before applying Update 2, verify that your injected kexts meet the following minimum versions. Using older kexts will produce either a kernel panic or silent boot failure (no video output).

Note that USBInjectAll version 0.7.1 introduced a new SSDT-UIAC override that bypasses the XHCI port limit change. If you are on a custom SSDT for USB ports, you will need to regenerate it after the update using the ioreg method described in the Wake on Bluetooth on a Hackintosh: Hardware, Kexts, and ACPI Patches for macOS 10.10–10.13 guide, as the port mapping offsets shifted.

Bootloader Configuration Adjustments

The most reliable approach is to apply Update 2 from a cloned boot drive, keeping your original drive untouched. Use Clover r4600 or later. The following boot-args are recommended for the first reboot after the update:

• -v (verbose mode to catch panic messages)
• keepsyms=1 (retain symbol names in panics)
• debug=0x100 (prevent automatic reboot on panic)
• npci=0x2000 (if using NVIDIA or AMD GPU with PCIe issues)

If you experience a kernel panic referencing AppleUSBXHCIPCI, add the boot flag uia_exclude=HS01,HS02 (adjust to your unused ports) to force USBInjectAll to skip problematic ports. For X99 systems, you may also need to set XHCIForceLPM=0 in your config.plist under KernelAndKextPatches -> KextsToPatch.

For GPU black screen issues, ensure that CsrActiveConfig in your config.plist is set to 0x67 (allow unsigned kexts) and that the Nvidia Web Driver is reinstalled before rebooting after the update. Use the nvda_drv=1 boot-arg and add NvidiaWeb under SystemParameters in Clover. If you are using a Maxwell or Pascal card, also add shikigva=40 to the boot-args to work around the VBIOS check.

Testing Procedure

1. Clone your current macOS installation to a separate SSD or HDD using Carbon Copy Cloner or Disk Utility restore.
2. Update the kexts in /EFI/CLOVER/kexts/Other to the minimum versions listed above.
3. Update Clover to r4600 or later (available from the official sourceforge repository).
4. Boot from the cloned drive and apply the Supplemental Update 2 via the App Store or a downloaded combo update.
5. Do not reboot immediately. After the update finishes, reinstall the Nvidia Web Driver (if applicable) and replace any kexts that were overwritten by the update (especially AppleUSBXHCI.kext and IOUSBHostFamily.kext – you can restore them from the original 10.13.6 build if needed, but test the updated versions first).
6. Reboot with verbose mode and watch for panics. If the system boots successfully, test USB ports, sleep/wake, and GPU acceleration.

If you encounter a panic at the AppleUSBXHCIPCI::start stage, reboot into your original drive and add the uia_exclude boot-arg. Alternatively, you can revert to the pre-update USB kexts by copying them from the 10.13.6 build 17G65 (the original release) into /System/Library/Extensions/ on the cloned drive, then rebuild the kernel cache with sudo kextcache -i / from Recovery. This is a last resort, as it defeats the purpose of the update, but it will restore USB functionality if you cannot tolerate the port limit change.

Sleep and Wake Regression

Several users on Gigabyte Z270X-Gaming 7 and ASUS Z170-A reported that after Update 2, the system would wake from sleep within two seconds of entering sleep, then immediately return to sleep. This is caused by a change in the AppleLPC driver that re-enumerates USB devices during the S3 resume sequence. The fix is to add a custom SSDT that disables the _PRW method on the USB root hub (see the Wake on Bluetooth 4 on Legacy Hackintosh: A Practical Guide for a similar approach – the same principle applies to disabling wake from USB devices). You can also set the darkwake=0 boot-arg, though this may break keyboard wake.

Long-Term Stability Notes

Supplemental Update 2 remains the final macOS 10.13.6 update. After applying it, your system is effectively “frozen” at that build (17G7022). Future security updates for High Sierra are delivered as separate “Security Update” packages that do not include the same kext changes, so you can safely apply those without repeating the USB port regression. However, if you ever need to reinstall macOS 10.13.6 from scratch, you will need to apply the combo update (not the delta) to reach 17G7022, then apply Update 2 on top. The delta update from 17G65 to 17G7022 is only 1.2 GB and can be downloaded from Apple’s support site if the App Store no longer offers it.

Before attempting any of these steps, verify that your backup is bootable. Power off, disconnect your main drive, and boot from the clone to confirm it works. Only then apply the update to your production system. If your hardware is older than Ivy Bridge (e.g., Sandy Bridge or X58), you may skip Supplemental Update 2 entirely – none of the fixes in it address security vulnerabilities on those platforms, and the USB changes can break legacy FireWire compatibility.