| Symptom | Likely Layer | Terminal Check | | :--- | :--- | :--- | | Red light from headphone jack (optical SPDIF stuck) | HDA codec state machine | sudo kextstat \| grep HDA | | Audio works after reboot but stops on wake | Power management (kext) | log show --predicate 'subsystem == "com.apple.audio"' | | Zoom audio works, Spotify doesn't | Core Audio mixing graph | sudo launchctl kickstart -k system/com.apple.audio.coreaudiod | | No sound, but volume keys change UI | Kernel to user-space IPC | sudo sysctl -a \| grep audio |

And when it breaks? Now you know exactly where to start looking.

At first glance, changing the volume on a MacBook is trivial: press a key, watch the icon bounce, and sound comes out. However, beneath this simplicity lies a layered, real-time software stack that is a marvel of systems engineering. The macOS audio driver is not a single file but an ecosystem of kernel extensions (kexts), user-space daemons, and hardware abstraction layers.

A virtual driver installs a kext that appears to the system as a real audio device. But instead of talking to hardware, its Read() method writes audio into a circular buffer. Another app reads from that buffer.