--- title: We Found a Ticking Time Bomb in macOS TCP Networking —... description: A 32-bit unsigned integer overflow in Apple's XNU kernel causes the internal TCP timestamp counter (tcp_now) to freeze after exactly 49 days, 17 hours, 2... canonical: https://daily.dev/posts/we-found-a-ticking-time-bomb-in-macos-tcp-networking-it-detonates-after-exactly-49-days-fmiqstlzx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: We Found a Ticking Time Bomb in macOS TCP Networking — It Detonates After Exactly 49 Days | daily.dev og:description: A 32-bit unsigned integer overflow in Apple's XNU kernel causes the internal TCP timestamp counter (tcp_now) to freeze after exactly 49 days, 17 hours, 2... og:url: https://daily.dev/posts/we-found-a-ticking-time-bomb-in-macos-tcp-networking-it-detonates-after-exactly-49-days-fmiqstlzx og:image: https://api.daily.dev/og/posts/FmiQsTLZx.png og:image:alt: We Found a Ticking Time Bomb in macOS TCP Networking — It Detonates After Exactly 49 Days og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # We Found a Ticking Time Bomb in macOS TCP Networking — It Detonates After Exactly 49 Days **[Hacker News](https://daily.dev/sources/hn)** · 14 min read · 0 upvotes · 0 comments ## Summary A 32-bit unsigned integer overflow in Apple's XNU kernel causes the internal TCP timestamp counter (tcp_now) to freeze after exactly 49 days, 17 hours, 2 minutes, and 47 seconds of continuous uptime. Once frozen, TIME_WAIT connections never expire, ephemeral ports exhaust, and eventually no new TCP connections can be established — while ICMP (ping) continues working normally. The bug was discovered on a fleet of long-running Mac machines monitoring an iMessage service, then reproduced live on two machines approaching the overflow threshold. The root cause is a monotonicity guard in calculate_tcp_clock() that prevents tcp_now from updating after the uint32_t wraps back near zero, permanently freezing the TCP clock. The cascade leads to thousands of stuck TIME_WAIT entries, SYN_SENT pileups, load spikes, and complete TCP failure. High-risk environments include macOS CI/CD servers, Mac Pro workstations, and colocated Mac fleets. A workaround beyond rebooting is in development. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [When "idle" isn't idle: how a Linux kernel optimization became a QUIC bug](https://daily.dev/posts/when-idle-isn-t-idle-how-a-linux-kernel-optimization-became-a-quic-bug-y5u5jcdr8) · Cloudflare · 48 upvotes · 0 comments --- Tags: [#networking](https://daily.dev/tags/networking), [#mac](https://daily.dev/tags/mac) [View this post on daily.dev](https://daily.dev/posts/we-found-a-ticking-time-bomb-in-macos-tcp-networking-it-detonates-after-exactly-49-days-fmiqstlzx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"We Found a Ticking Time Bomb in macOS TCP Networking — It Detonates After Exactly 49 Days","url":"https://daily.dev/posts/we-found-a-ticking-time-bomb-in-macos-tcp-networking-it-detonates-after-exactly-49-days-fmiqstlzx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/we-found-a-ticking-time-bomb-in-macos-tcp-networking-it-detonates-after-exactly-49-days-fmiqstlzx"},"datePublished":"2026-04-06T21:47:10.711Z","dateModified":"2026-04-06T21:47:44.926Z","description":"A 32-bit unsigned integer overflow in Apple's XNU kernel causes the internal TCP timestamp counter (tcp_now) to freeze after exactly 49 days, 17 hours, 2...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a6b7832d0981b14317c2ab232764a76f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a6b7832d0981b14317c2ab232764a76f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/we-found-a-ticking-time-bomb-in-macos-tcp-networking-it-detonates-after-exactly-49-days-fmiqstlzx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"networking,mac","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"We Found a Ticking Time Bomb in macOS TCP Networking — It Detonates After Exactly 49 Days"}]} ```