MacOS – Kernel panic on every attempt to access Recovery Mode

kernel-panicmacosrecovery

I was trying to access the Recovery Mode on my MacBook Pro5,3 with OSX El Capitan 10.11.6, however every attempt ended in Kernel Panic (KP).
I would see the Apple logo with a loading bar and the following console-like text as an overlay:

panic(cpu 0 caller 0xffffff8013b9654e): "Process 1 exec of /sbin/launchd failed, errno 5"@/Library/Caches/com.apple.xbs/Sources/xnu/xnu-3248.60.10/bsd/kern/kern_exec.c:4584
Backtrace (CPU 0), Frame : Return Address
0xffffff8117153de0 : 0xffffff80136dab52 
0xffffff8117153e60 : 0xffffff8013b9654e 
0xffffff8117153ee0 : 0xffffff8013b6df9b 
0xffffff8117153f00 : 0xffffff8013bb3dd1 
0xffffff8117153f40 : 0xffffff80136d54cd 
0xffffff8117153f80 : 0xffffff80137cef3e 
0xffffff8117153fa0 : 0xffffff80137ec52f 

BSD process name corresponding to current thread: init
Boot args: rp=file:///com.apple.recovery.boot/BaseSystem.dmg

Mac OS version:
Not yet set

Kernel version:
Darwin Kernel Version 15.6.0: Thu Jun 23 18:25:34 PDT 2016; root:xnu-3248.60.10~1/RELEASE_X86_64
Kernel UUID: B5AA8E3E-65B6-3D0E-867B-8DCCF81E536C
Kernel slide:     0x0000000013400000
Kernel text base: 0xffffff8013600000
__HIB  text base: 0xffffff8013500000
System model name: MacBookPro5,3 (Mac-F22587C8)

System uptime in nanoseconds: 1874205854

What I have tried

  • Rebooting with CMD+R – results in KP
  • Rebooting with Option+CMD+R – results in KP
  • Rebooting with Shift+Option+CMD+R – results in KP
  • Rebooting with Option and then selection the Recovery partition – results in KP
  • I found that the BaseSystem.dmg on the Recovery HD partition was corrupted, so I replaced it (together with the BaseSystem.chunklist file) with a fresh version from the El Capitan installer. To no avail, I got a KP again, albeit a slightly different one:
    panic(cpu 0 caller 0xffffff8003c3995e): "A kext releasing a(n) BroadcomBluetoothHostControllerUSBTransport has corrupted the registry."@/Library/Caches/com.apple.xbs/Sources/xnu/xnu-3248.60.10/libkern/c++/OSObject.cpp:200

What else can I try?

My final goal is to boot to Recovery, disable csrutil, patch a system file such that my headphones don't launch iTunes automatically, then enable csrutil again.

Notes

Booting to Safe Mode by holding Shift during startup does work as expected.

Best Answer

After I forgot this issue for a while I stumbled upon a very useful tool made by Chris Silvertooth. The latest version of his Recovery Partition Creator can be found on his download page.

Using the application is very simple, I have successfully recreated my recovery partition on El Capitan (OS X 10.11.6):

  1. (Optional but recommended) Create a full backup of your system
  2. Download the most recent Recovery Partition Creator
  3. Download the relevant OS X installation files from the App Store
    • Open the App Store
    • Open the Purchased tab
    • Find the installation file of the OS you're trying to add a recovery partition to and download it
  4. Start the Recovery Partition Creator and follow the steps described in the dialogs. At some point you will need to point it to the installation files downloaded in the previous step.
Related Question