Mojave install crashes after power on login

Found both old Coriolis iDefrag and Little Snitch 3 kexts present in the system. Uninstalled LS3 and deleted the iDefrag stuff which I had deleted the app for ages ago.

MBA now boots.

In more detail.

Checked the system reports in Console.app and found kernel panics by time. I'm no expert in reading trace files, but that this showed up caused some concern.

0xffffff80b4c1bfa0 : 0xffffff80213590ce 
  Kernel Extensions in backtrace:
     com.coriolis-systems.driver.Snapshot(113.0)[B6C0FE6D-76C9-3C71-A43A-2D67ED604116]@0xffffff7fa1ffe000->0xffffff7fa2075fff
        dependency: com.apple.iokit.IOStorageFamily(2.1)[499E27C9-AC4D-3239-9FC4-754C7699FA76]@0xffffff7fa1fce000

After doing a check to remind me what this was from I found it was an old installation of iDefrag from the pre-SSD days. Although I had removed iDefrag a long time ago when moving to SSD it seems the kexts did not cause an issue up to Mojave.

I checked to see what other items had been quarantined by the Mojave install process, going by what had been reported in the syslog I searched for The Coriolis kexts and found them in the following folder (the migration folder name has been anonymised here...)

$ cd /Library/SystemMigration/History/Migration-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/QuarantineRoot/Library/StagedExtensions/Library/Extensions
$ ls -l
total 0
drwxr-xr-x  3 root  wheel  96 12 Jun  2014 ACS6x.kext
drwxr-xr-x  3 root  wheel  96 27 Jun  2016 ATTOCelerityFC8.kext
drwxr-xr-x  3 root  wheel  96 27 Jun  2016 ATTOExpressSASHBA2.kext
drwxr-xr-x  3 root  wheel  96 27 Jun  2016 ATTOExpressSASRAID2.kext
drwxr-xr-x  3 root  wheel  96 20 Aug  2013 ArcMSR.kext
drwxr-xr-x  3 root  wheel  96  1 Sep  2013 CalDigitHDProDrv.kext
drwxr-xr-x  3 root  wheel  96 11 Apr  2017 CoriolisOnlineHelper.kext
drwxr-xr-x  3 root  wheel  96 11 Apr  2017 CoriolisSnapshot.kext
drwxr-xr-x  3 root  wheel  96 15 Aug  2014 HighPointIOP.kext   
drwxr-xr-x  3 root  wheel  96 15 Aug  2014 HighPointRR.kext
drwxr-xr-x  3 root  wheel  96  5 Dec  2017 LittleSnitch.kext
drwxr-xr-x  3 root  wheel  96 31 Mar  2017 PromiseSTEX.kext
drwxr-xr-x  3 root  wheel  96 22 Aug  2017 SoftRAID.kext

That the LittleSnitch.kext was also present here gave me the clue that Little Snitch 3 was possibly incompatible. After verifying this on the OBDev website I removed LS3 using the uninstaller https://www.obdev.at/support/index.html?product=LS&topic=faq&entry=245442241039726

Although kexts get quarantined it appears they are still present in the system somewhere, so the uninstall seemed the best approach. Indeed the LS3 uninstaller rebuilt boot caches.

The normal boot now succeeds.

You know that working in Safe mode means all your non Apple apps are disabled.

So you can find the problematic one in Safe mode by turning them on one by one.

Here is what Apple says about that.

https://support.apple.com/en-us/HT201262

There is also a complete system diagnose report created by

sudo sysdiagnose -f ~/Desktop/

that runs system diagnostics and creates a text file. It might take 5 minutes to complete the report.