WindowServer crashing intermittently after Big Sur update

Well, this one is puzzling. At first glance, it looks like something is trying to record your screen, and when WindowServer is requesting access, that request is getting timed out and causes WS to be terminated by xpc. Since from your description it doesn't sound like you're trying to take a screenshot/screencap, I can only theorize on possibilities:

• You have Screen Sharing or Remote Management enabled in System Preferences -> Sharing and someone is trying to view your screen.
• You have software or malware installed that takes screenshots/caps at certain times.
• You have certain Accessibility features enabled.

None of the above should, in general, fail in the way that you're seeing, though. So you can check your settings in System Preferences and disable sharing & accessibility features as a test, but that would be a workaround at best, not a root cause & fix. (The malware possibility is there, too, but I'm always hesitant to go down that route until we've ruled out more benign causes.)

It should be noted that Big Sur has been a very buggy release and a lot of errors in particular pertain to WindowServer, so my suspicion is that what you're seeing is not at all your fault.

Here are things to try:

1. System Preferences -> Sharing: Disable Screen Sharing and Remote Management, if enabled.
2. System Preferences -> Accessibility: Disable any accessibility features you may have enabled.
3. System Preferences -> Security & Privacy -> Accessibility: Disable all apps and share a list of them in your question.
4. System Preferences -> Security & Privacy -> Screen Recording: Disable all apps and share a list of them in your question.
5. If steps 1-4 don't help, the next time this happens, capture a sysdiagnose after rebooting from your crash and we can try to dig into your logs. You can do this either via the sysdiagnose command in Terminal or by pressing and holding the ShiftControlOptionCommand keys together and while holding these keys pressing and releasing the period . key.

This is an over-sized comment, because I don’t have the solution either.

I came across this bug yesterday, and I checked the crash reports. There were five crashes related to WindowServer, forming a crash loop (i.e. crash -> reboot -> log-in -> crash). Some of them are similar to the one in the question; their Termination Details field mentioned “unresponsive work processor” as the crashing context. Other crashes mention (formatted for readability)

is_alive_func returned unhealthy: WindowServer initialization not complete (post IOKitWaitQuiet)

instead. Remarkably, for all crashes, the stack trace of the crashing thread starts with

0   libsystem_kernel.dylib          0x00007fff204c82ba mach_msg_trap + 10
1   libsystem_kernel.dylib          0x00007fff204c862c mach_msg + 60
2   libdispatch.dylib               0x00007fff203697a0 _dispatch_mach_send_and_wait_for_reply + 530
3   libdispatch.dylib               0x00007fff20369bba dispatch_mach_send_with_result_and_wait_for_reply + 50
4   libxpc.dylib                    0x00007fff202421a8 xpc_connection_send_message_with_reply_sync + 238

The line following XPC (cross-process communication?) library varies from com.apple.LaunchServices to com.apple.HIDPreferences, so I suspect that something is wrong with the XPC library.

Note that the hex number (address of the method?) is different from OP, but it’s probably because of macOS version (I’m iMac at 11.6.1); the method names fully match, and offsets mostly match.

Another note: the crashing thread in the question is always com.apple.tcc.preflight.kTCCServiceScreenCapture, but my experience was different. Only one of my reports crashed at this thread. Others crashed at com.apple.main-thread. I suspect that the screenshot is only one way to trigger this bug.