diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md
index a057e28..d9022d2 100644
--- a/docs/TROUBLESHOOTING.md
+++ b/docs/TROUBLESHOOTING.md
@@ -62,6 +62,10 @@ LaunchServices dereferenced a nullable error-output pointer in six paths. The pa
 
 LaunchServices now opens `http`, `https` and `mailto` links on the Linux desktop itself. It loads the host's `libsystemd.so.0` and asks `xdg-desktop-portal` (`org.freedesktop.portal.OpenURI`) on the user session bus to open the link, so your default browser starts outside Darling and survives `darling shutdown`. Without a portal, it starts `xdg-open` in a transient systemd user unit instead. It also reports a handler for these schemes, since Electron checks for one before opening a link. Other schemes, control characters and URLs over 4096 bytes are rejected. If a link still does nothing, check the client's stderr for a `LaunchServices:` line and that `busctl --user status org.freedesktop.portal.Desktop` works on the host. Both LaunchServices and AppKit must be rebuilt; the old `/private/tmp/rclol-open` spool and `tools/riot-open-url-bridge.py` are obsolete. The hand-off passed the host-side D-Bus regression and opened the host browser from a guest through both `open(1)` and `NSWorkspace`; a link clicked in the Riot client is not yet confirmed. The null-pointer fix does not explain every unrelated button crash.
 
+## `LOLSIGFAIL … addr=0x143` every 10 seconds
+
+`iokitd` crashed in host glibc's `pthread_mutex_lock` and launchd restarted it every 10 seconds. It called `eglGetDisplay()` with an Xlib display, so Mesa picked the platform from `EGL_PLATFORM`. Wayland sessions often set that to `wayland`, and the first `darling` command passes its environment to every guest service, including `iokitd`. `scripts/run.sh` sets `EGL_PLATFORM=x11` and was unaffected, but `darling shell` from a Wayland terminal (including the one in `scripts/install-runtime.sh`) started the loop. `iokitd` now requests the X11 platform explicitly. The fix is part of the base install (`sudo cmake --install`); until then, start Darling with `EGL_PLATFORM=x11`.
+
 ## Blocky video or flickering startup logo
 
 The first dynamically resolved GL call could lose floating-point arguments during ELF symbol lookup. Chromium's linear sampler request then failed and left nearest sampling. The generated resolver now preserves those registers. Install both the rebuilt native `libGL.dylib` in `RuntimeLibraries` and the OpenGL framework's library copy using the paired runtime installer; the framework alone is insufficient.
diff --git a/patches/iokitd.patch b/patches/iokitd.patch
index d79becd..e12b70b 100644
--- a/patches/iokitd.patch
+++ b/patches/iokitd.patch
@@ -103,6 +103,29 @@ index 50c10fe..bd501cf 100644
 +	CFRelease(data);
 +	return kr;
 +}
+diff --git a/src/IOSurfaceRoot.mm b/src/IOSurfaceRoot.mm
+index d7e6fab..d860582 100644
+--- a/src/IOSurfaceRoot.mm
++++ b/src/IOSurfaceRoot.mm
+@@ -21,13 +21,17 @@
+ #include "iokitd.h"
+ #include "IOSurface.h"
+ #include "IODisplayConnectX11.h"
++#include <EGL/eglext.h>
+ #include <IOKit/IOCFUnserialize.h>
+ #include <stdexcept>
+ #include <iostream>
+ 
+ IOSurfaceRoot::IOSurfaceRoot()
+ {
+-	m_display = eglGetDisplay(IODisplayConnectX11::getDisplay());
++	// The native display is an Xlib Display. eglGetDisplay() would let Mesa
++	// guess the platform from EGL_PLATFORM, which Wayland sessions often set
++	// to "wayland"; Mesa then treats the Display as a wl_display and crashes.
++	m_display = eglGetPlatformDisplay(EGL_PLATFORM_X11_KHR, IODisplayConnectX11::getDisplay(), NULL);
+ 
+     if (m_display == EGL_NO_DISPLAY)
+         return;
 diff --git a/src/PowerSources.mm b/src/PowerSources.mm
 new file mode 100644
 index 0000000..70ca9bd
diff --git a/upstream/manifest.json b/upstream/manifest.json
index 4a362c2..d3df87a 100644
--- a/upstream/manifest.json
+++ b/upstream/manifest.json
@@ -124,7 +124,7 @@
       "revision": "5549ac4cd2db923c256f016a1381b3bfb716730a",
       "repository": "https://github.com/darlinghq/darling-iokitd.git",
       "patch": "patches/iokitd.patch",
-      "modified_files": 7,
+      "modified_files": 8,
       "new_files": [
         "src/PowerSources.mm",
         "src/IOPlatformExpertDevice.h",