pymobiledevice3 sometimes hanging, blocked by a read while working with `netmuxd`

[eigenphase]

Test environment

• Ubuntu noble
• iPhone 14 Pro iOS 26

Describe the bug
Sometimes pymobiledevice3 hangs in the background. It seems read syscall is blocking...

To Reproduce
Unfortunately hard to reproduce. Happens every couple of days.

Additional context

I have set up pymobiledevice3 to pull backups of my iPhone automatically and wrapped a script around. This script has a lock that allows only one execution (via PID and lock file). Every few days, pymobiledevice3 hangs and then no new instances of my script can run until I kill the old instance. It is not clear under which condition it hangs.

In the latest instance, it hangs with this command in my script:

# 2. check if iPhone is reachable                                                                                                                                                                                                                   
if ! "$PYMOBILEDEVICE3" usbmux list 2>/dev/null | grep -q "$UDID"; then                                                                                                                                                                                                                                                                                                                                                                                
    exit 0                                                                                                                                                                                                                                          
fi  

The relevant process tree looks like this:

 324135 ?        S      0:00  \_ /usr/sbin/CRON -f -P
 324137 ?        Ss     0:00      \_ /bin/sh -c /home/user/scripts/miPhone_backup.sh >> /home/user/scripts/miPhone_backup.log
 324140 ?        S      0:00          \_ /bin/bash /home/user/scripts/miPhone_backup.sh
 324144 ?        S      0:00              \_ /home/user/.local/share/pipx/venvs/pymobiledevice3/bin/python /home/user/.local/bin/pymobiledevice3 usbmux list
 324145 ?        S      0:00              \_ grep -q 00008538-000819993413C01E

I tried attaching strace to the process but unfortunately can't find more details than a read from file descriptor 3 is blocking:

$ sudo strace -p 324144
[sudo] password for user:
strace: Process 324144 attached
read(3, ^Cstrace: Process 324144 detached
 <detached ...>

Below is the stack trace via py-spy:

$ sudo /home/user/.local/bin/py-spy dump --pid 324144
Process 324144: /home/user/.local/share/pipx/venvs/pymobiledevice3/bin/python /home/user/.local/bin/pymobiledevice3 usbmux list
Python v3.12.3 (/usr/bin/python3.12)

Thread 324144 (idle): "MainThread"
    do_handshake (ssl.py:1320)
    _create (ssl.py:1042)
    wrap_socket (ssl.py:455)
    ssl_start (pymobiledevice3/service_connection.py:361)
    validate_pairing (pymobiledevice3/lockdown.py:399)
    _handle_autopair (pymobiledevice3/lockdown.py:627)
    create (pymobiledevice3/lockdown.py:200)
    create_using_usbmux (pymobiledevice3/lockdown.py:878)
    usbmux_list (pymobiledevice3/cli/usbmux.py:111)
    invoke_with_dependencies (typer_injector/_inject.py:107)
    wrapper (typer_injector/_inject.py:136)
    wrapper (typer/main.py:1514)
    invoke (click/core.py:824)
    invoke (click/core.py:1269)
    invoke (click/core.py:1873)
    invoke (click/core.py:1873)
    _main (typer/core.py:188)
    main (typer/core.py:795)
    __call__ (click/core.py:1485)
    __call__ (typer/main.py:1135)
    invoke_cli_with_error_handling (pymobiledevice3/__main__.py:315)
    main (pymobiledevice3/__main__.py:425)
    <module> (pymobiledevice3:6)

The backup target is stored on a local SSD (ZFS dataset) so it can't really be blocking there.

If there is any other debug info I can provide I am happy to share once the issue pops up next time (probably in a few days).

I set up this script about a week ago and I am very excited about it but this issue happened now already the third time.

At least one other time it did not hang on "usbmux list" but "backup2 backup --udid xxx --no-full" call.

For community

⬇️ Please click the 👍 reaction instead of leaving a +1 or 👍 comment

[doronz88]

Thanks for reporting! Can you please test if this PR maybe solves the issue, as I plan to merge it soon:

#1571

[eigenphase]

Thank you!

I am afraid it did not fix. I clones git repo and checkout out the PR:

$ pymobiledevice3 version
7.8.3.dev2+gb58718b54

This morning my script started the backup again; process started at 7:40:

$ stat /proc/502970
  File: /proc/502970
  Size: 0               Blocks: 0          IO Block: 1024   directory
Device: 0,72    Inode: 183483671   Links: 9
Access: (0555/dr-xr-xr-x)  Uid: ( 1000/    user)   Gid: ( 1009/    user)
Access: 2026-03-02 07:40:50.782838118 -0800
Modify: 2026-03-02 07:40:50.782838118 -0800
Change: 2026-03-02 07:40:50.782838118 -0800
 Birth: -

Now it's:

$ date
Mon Mar  2 10:01:29 PST 2026

and there is no active backup process on my phone; actually I switched Wifi a couple of times.

Same issue:

$ sudo strace -p 502970
[sudo] password for user: 
strace: Process 502970 attached
epoll_wait(3, ^Cstrace: Process 502970 detached
 <detached ...>
$ sudo /home/user/.local/bin/py-spy dump --pid 502970
Process 502970: /home/user/.local/share/pipx/venvs/pymobiledevice3/bin/python /home/user/.local/bin/pymobiledevice3 backup2 backup --udid ******** --no-full /srv/imazing/miPhone_backup
Python v3.12.3 (/usr/bin/python3.12)

Thread 502970 (idle): "MainThread"
    select (selectors.py:468)
    _run_once (asyncio/base_events.py:1949)
    run_forever (asyncio/base_events.py:641)
    run_until_complete (asyncio/base_events.py:674)
    wrapper (pymobiledevice3/cli/cli_common.py:135)
    invoke_with_dependencies (typer_injector/_inject.py:107)
    wrapper (typer_injector/_inject.py:136)
    wrapper (typer/main.py:1514)
    invoke (click/core.py:824)
    invoke (click/core.py:1269)
    invoke (click/core.py:1873)
    invoke (click/core.py:1873)
    _main (typer/core.py:188)
    main (typer/core.py:795)
    __call__ (click/core.py:1485)
    __call__ (typer/main.py:1135)
    invoke_cli_with_error_handling (pymobiledevice3/__main__.py:320)
    main (pymobiledevice3/__main__.py:430)
    <module> (pymobiledevice3:6)
Thread 502972 (idle): "Thread-1"
    wait (threading.py:359)
    wait (threading.py:655)
    run (tqdm/_monitor.py:60)
    _bootstrap_inner (threading.py:1073)
    _bootstrap (threading.py:1030)

I remember in the morning I got the password prompt on the phone but ignored it. In any case, this can't the the only way it hangs as in the example in my initial post it was "usbmux list".

[doronz88]

I suspect it has something to do with the linux libimobiledevice specific implementation since I have never encountered it nor have any of my colleagues. Since I dont use a linux machine as default it'll be harder for me to get to the root cause. If you manage to find the root cause please update.

[eigenphase]

Unfortunately no expert here, do you have advice how I can get insight where things get stuck?
For example, does the stack traces above provide any insight in which area it gets stuck?
Any debug messages I could enable/add?

[prosch88]

Are you using usbmuxd2? I had issues with this getting stuck while the "default" usbmuxd worked very stable.

[eigenphase]

Thanks for the datapoint!
I am actually using netmuxd since I am doing backups over network.
Default "usbmuxd" only does USB, right?

[prosch88]

Correct.

[doronz88]

Specifically for linux you are correct. The windows and macOS Apple implementations support network devices.
My only idea is just printing every message sent and received inside the usbmux client and see what happens.
I'm starting to think that maybe netmuxd maybe just dies or closes the connection at some point? Try looking for its PID before and after

[eigenphase]

I just checked and it's been running for over a week:

# systemctl status netmuxd
● netmuxd.service - netmuxd - network muxer for iOS devices
     Loaded: loaded (/etc/systemd/system/netmuxd.service; enabled; preset: enabled)
     Active: active (running) since Sun 2026-02-22 21:00:31 PST; 1 week 0 days ago
   Main PID: 710 (netmuxd-x86_64-)
      Tasks: 6 (limit: 38180)
     Memory: 4.9M (peak: 11.5M)
        CPU: 12min 19.109s
     CGroup: /system.slice/netmuxd.service
             └─710 /usr/local/sbin/netmuxd-x86_64-linux-gnu

Mar 02 14:40:01 edward netmuxd-x86_64-linux-gnu[710]:         ConnectionType: "Network",
Mar 02 14:40:01 edward netmuxd-x86_64-linux-gnu[710]:         DeviceID: 1,
Mar 02 14:40:01 edward netmuxd-x86_64-linux-gnu[710]:         EscapedFullServiceName: "_apple-mobdev2._tcp.local",
Mar 02 14:40:01 edward netmuxd-x86_64-linux-gnu[710]:         InterfaceIndex: 1,
Mar 02 14:40:01 edward netmuxd-x86_64-linux-gnu[710]:         NetworkAddress: Data(02 00 00 00 0A E3 4F 94 00 00 00 00 00 00 00 00 00 00 00 00... Len: 152),
Mar 02 14:40:01 edward netmuxd-x86_64-linux-gnu[710]:         SerialNumber: "00008120-000818883413C01E"
Mar 02 14:40:01 edward netmuxd-x86_64-linux-gnu[710]:       }
Mar 02 14:40:01 edward netmuxd-x86_64-linux-gnu[710]:     }
Mar 02 14:40:01 edward netmuxd-x86_64-linux-gnu[710]:   ]
Mar 02 14:40:01 edward netmuxd-x86_64-linux-gnu[710]: }
# 

Also journalctl doesnt' show anything suspicious.

[doronz88]

You can still patch around each send and recv of the client code. Maybe the netmuxd has his own logs you can look into (Haven't used that tool so I have no idea)