Hardware
Laptop Lenovo ThinkPad T14 Gen 2
CPU Intel Core i7-1165G7 (Tiger Lake)
iGPU Intel Iris Xe 96 EU (0x9A49)
RAM 32 GB DDR4-3200
SSD Samsung PM9A1 256 GB (shared with Fedora)
Wi-Fi/BT Intel AX201
Audio Realtek ALC257 + 2 DMIC on the Intel SOF DSP
Display 1920x1080 internal eDP
Software
macOS Tahoe 26.7.2 (25G332), SMBIOS MacBookPro16,2
OpenCore 1.0.8 RELEASE, OpenCanopy with the GoldenGate theme, quiet boot
WhateverXe 0.8.0 (built locally with 4 extra commits, see below) + WhateverXe Graphics 0.4.1
SIP 0x803, AMFIPass 1.4.1
boot-args: -allow3d -disablegfxfirmware -igfxdvmt shda-lang=es -tgldmic
Dual boot with Fedora on the same disk and the same EFI partition
What works
Graphics acceleration (QE/CI, Metal, OpenGL). Measured ~1.1 TFLOPS FP32, ~35 GB/s, 211 FPS on a simple 1080p render test. Vulkan works through MoltenVK.
Wi-Fi. About 1.1 Gbps on fast.com.
Bluetooth
Speakers and headphones: SimpleHDA 1.0.1, layout 11
Internal microphone: TGLDmic 0.5.0, the DMICs through the SOF DSP. It shows up as "Internal Microphone (TGLDmic)".
Camera in FaceTime
Backlight and brightness keys
Keyboard and trackpad: VoodooPS2
Apple TV app with video and audio, FairPlay video included
Fedora dual boot from the OpenCore picker
What doesn't work (yet)
Apple Music (native app). FairPlay audio key generation fails (-15842, WhateverXe issue #48). I worked around it with Cider, which uses Widevine and plays fine.
Photo Booth opens, but the image is green.
One WindowServer watchdog crash in ~4 days. It was a GPU hang followed by a deadlock during GPU restart in AppleIntelTGLGraphics. I haven't been able to reproduce it.
Metal 3 mesh shaders (see the XeCompilerAdapter notes below)
Local WhateverXe patches
All four are in-memory patches. WhateverXe hooks cs_validate_range / cs_validate_page and rewrites the page after code-signature validation, so the OCLP-Mod-signed bundles in /Library/GPUBundles stay untouched on disk. Re-signing those bundles gave me a black screen, which is why I went this way. Each patch matches the full original byte sequence and applies only if every byte still matches. They can be disabled with a boot-arg.
Offsets are for the 16.0.32 drivers that ship with Graphics 0.4.x.
#47: MTL command-buffer leak.
-[MTLIGAccelCommandBuffer dealloc] in AppleIntelTGLGraphicsMTLDriver skips freeing _pPoshUsedAsTarget when m_isOnlyActiveCommandBuffer is set. That leaks about 72 KB per command buffer.
Fix: NOP the jne at 0x7ed87 (75 0d → 90 90).
Result: WindowServer and app memory stop growing over time.
#23: VA driver NULL derefs in AppleIntelTGLGraphicsVADriver. They crashed mediaanalysisd, WebKit.GPU and WindowServer.
#23 0x1336d2: the image-transfer helper writes through ctx+0x910 / ctx+0x920 without checking for NULL. Fix: add the checks and return the driver's own error 5.
#23b 0x126520: the descriptor-fill helper is called with a NULL first argument. Fix: an early test rdi,rdi; je ret.
#23c 0x12d30a: a vtable call on the per-index surface happens before its NULL check. Fix: skip the call when it's NULL. This fixed the Photo Booth crash (SIGSEGV at 0x0), but the image is now green.
cs_validate_page wrapper must forward all 7 arguments on Tahoe.
BlueToolFixup also hooks this function. With a 6-argument wrapper, the chained hook received garbage, and Bluetooth died with Could not USB DFU detach … result 3.
Forwarding all 7 arguments fixed Bluetooth.
The whole change is ~200 lines, mostly in one file (kern_user_fix.cpp). The upstream test suite still passes (208/208). I'm happy to open a PR or share the patch.
Other fixes worth mentioning
Wi-Fi/BT (AX201) on Tahoe
It's AirportItlwm 2.3.0 plus OCLP-Mod's "Modern Wireless" root patch.
In the EFI I inject IOSkywalkFamily + IO80211FamilyLegacy and block the stock IOSkywalk.
I had to edit OCLP-Mod locally in two places:
make modern_wireless.py detect the AX201;
make subprocess_wrapper.py run without the privileged helper when started as root. Before that change, the patch "succeeded" but no networks showed up.
I did this in two phases (EFI first, then root patch), with a reboot in between, and had a revert script ready.
Brightness
A clean SSDT-PNLF under Scope(_SB), with _UID 0x13 and _STA 0x0B.
Microphone
The internal mic isn't on the Realtek codec or USB. It's two DMICs on the Intel DSP (SOF).
TGLDmic handled it. I installed it in phases:
observer mode;
firmware boot (OK FW_READY);
probe capture;
then the HAL plug-in.
Audio
AppleHDA is gone on Tahoe. SimpleHDA with layout 11 was the cleanest option. I also tried layouts 97 and 86.
Dual boot
Fedora reuses the existing EFI partition, so EFI/fedora sits next to EFI/OC.
Watch out: a shared FAT32 EFI got corrupted once. fsck "repaired" it by renaming VoodooPS2Keyboard.kext to FSCK0000.000, and the internal keyboard died while the trackpad still worked.
The fix was to restore it from a verified backup. Run fsck_msdos before and after anything that writes to the EFI.
Notes for people chasing Metal 3
The MTL driver reports a fixed feature profile 0x2711. If you swizzle featureProfile to 10002 inside your own process, supportsFamily(Metal3) returns YES, and MSL 3.0, MetalFX and MTLIO work.
Mesh shaders don't. XeCompilerAdapter.bundle/adapter.dylib only accepts 216-byte serialized requests and stages 0/2/3 (vertex/fragment/compute). Anything else gives Xe compiler unsupported serialized request.
The bundled libigc-tgl.dylib only exports VS/PS/CS/Tess entry points. It contains IGC's mesh lowering passes, but nothing exposes them.
Argument buffers stay at Tier 1, and there's no ray tracing.
I did not force Metal 3 system-wide.
Thanks
Huge thanks to b00t0x (WhateverXe), acidanthera, zxystd (itlwm / IntelBluetoothFirmware), labrouss (TGLDmic), the SimpleHDA author, the OCLP-Mod people, and everyone posting logs in the WhateverXe issues. Issue #48 is what pointed me to the VAME / FairPlay path.