diff --git a/lib/images/macos/README.md b/lib/images/macos/README.md
index 1ae904a..256fe0e 100644
--- a/lib/images/macos/README.md
+++ b/lib/images/macos/README.md
@@ -92,10 +92,18 @@ VirtualSMC-only, PE install — 3 of 3 builds completed:
 | 2   | 26      | 7            | 1             | 1                       | 0             |
 | 3   | 26      | 7            | 1             | 1                       | 0             |
 
-What still happens: a kernel panic at one of the guest's own reboots during the
-install (GPF in launchd's context right after `MACH Reboot`). XNU reboots
-itself within seconds and the install continues; the driver only intervenes
-if no kernel comes back within 60 s. Known, logged, not yet root-caused.
+What still happens: at roughly one in ten guest-initiated reboots the guest
+either panics (GPF in launchd/kernel_task context shortly after `MACH Reboot`
+or within the first 15 s of the next boot — tmpfs/APFS/zone corruption
+signatures, i.e. memory or register state, not one driver) or never comes back
+(dead after `IOPlatformHaltRestartAction`). XNU reboots itself after a panic;
+the driver resets a dead guest after 60 s, so builds complete. A device bisect
+(`tools`-style 10–30 PE reboots per variant: VMware SVGA vs std VGA, no HDA,
+EHCI input, 1 vCPU) showed the rate is independent of the emulated devices and
+of SMP; Haswell-noTSX does not boot Tahoe. Host: AMD Zen 4, kvm_amd, Intel
+Skylake-Client vCPU model — the FPU-context-switch panic points at XSAVE state
+handling on that combination. Not fixed; a `vmix run` VM that hangs on Restart
+must be reset from the host.
 
 ## Debugging