# Whonix 18.2.4.2 arm64 ported to Apple Silicon M3 via UTM with build fixes

> **Key takeaway:** A community build of Whonix 18.2.4.2 for arm64 on Apple Silicon M3 reveals multiple upstream issues including Sequoia signature verification dependencies, QEMU raw image incompatibility with APFS discard, hardcoded x86_64 syscall filters in kloak, and a network socket binding to 0.0.0.0 by default.

**Published:** 2026-10-31T13:26:14+00:00 
**Source:** Whonix Privacy & Anonymity OS Blog 
**Category:** mobile-hardened 
**Canonical URL:** https://fosswire.org/news/whonix-18242-arm64-ported-to-apple-silicon-m3-via-utm-with-b.html 

## Summary
A community contributor has successfully built and run Whonix 18.2.4.2 (LXQt flavor) on an Apple M3 Pro using UTM 5.0.8, documenting the deviations required from official wiki instructions. The build process on Debian 13 trixie required installing Sequoia tools (sqop, sequoia-git) for signature verification that derivative-maker now mandates, plus specifying the new mandatory --freshness flag. Post-build, importing the generated UTM bundles required converting raw disk images to qcow2 format to work around QEMU drive errors caused by APFS rejecting unaligned fcntl(F_PUNCHHOLE) operations on raw files, a macOS-specific code path lacking the EINVAL fallback present on Linux.

Runtime fixes were also needed: the kloak anti-keylogger service crashed in a SIGSYS loop because its systemd SystemCallFilter only listed legacy x86_64 syscall names, missing arm64 equivalents like faccessat; the gateway VM's internal network socket bound to 0.0.0.0:8010 rather than localhost; and wlr-resize-watcher forced a 1920x1080 resolution that UTM cropped on a 14-inch MacBook Pro display, hiding the LXQt panel.

## Apple Silicon port fixes and upstream gaps
- **Sequoia signature verification:** derivative-maker now requires sqop and sequoia-git packages for signature verification, which are not listed in current wiki dependency instructions for Debian 13 trixie hosts, causing build abort at step 1100_sanity-tests.
- **Mandatory freshness flag:** The --freshness parameter (current or frozen) is now required for derivative-maker builds but was not previously documented for this workflow.
- **QEMU/APFS raw image incompatibility:** Generated raw disk images fail to boot in UTM on macOS with 'Invalid argument' errors; the root cause appears to be UTM's discard=unmap,detect-zeroes=unmap passing through to APFS via fcntl(F_PUNCHHOLE), which rejects non-4K-aligned ranges without the EINVAL fallback that Linux implements. Converting to qcow2 avoids this because qcow2 punches whole clusters only.
- **kloak arm64 syscall mismatch:** The kloak.service SystemCallFilter lists only legacy x86_64 syscall names, causing SIGSYS crashes on arm64 where syscall 48 is faccessat. A systemd drop-in adding faccessat, ppoll, epoll_pwait, epoll_pwait2, and unlinkat resolves the crash loop.
- **Gateway network exposure:** The generated UTM bundle configures the gateway's internal socket to listen=:8010 (0.0.0.0), exposing the internal interface to the local network rather than binding to 127.0.0.1 as the workstation's connect endpoint already does.

## Why it matters
This community documentation directly benefits privacy-focused users who need Whonix on Apple Silicon hardware, a platform Whonix does not officially support. The identified issues—particularly the Sequoia dependency gap, the missing arm64 syscall filters in kloak, and the QEMU/macOS discard behavior—represent actionable upstream bugs that Whonix and derivative-maker maintainers can now address. For the broader open-source security ecosystem, the kloak SystemCallFilter problem highlights a recurring portability failure when systemd unit hardening assumes x86_64 syscall naming conventions across architectures.