Kernel panic faults (KPFaults) disrupt large-scale infrastructures. While logs are the primary diagnostic resource, they exhibit continuous semantic drift driven by the evolution of diverse online services and hardware heterogeneity. Existing methods fail to adapt to this drift. However, employing online learning to address this drift encounters two operational bottlenecks: the sparsity of KPFault-indicating logs and the heavy burden of manual intervention. To address this, we propose PanicGuard, an incremental diagnosis framework driven by online learning. PanicGuard integrates Fault-Indicating Representation Extraction (FIRE) to autonomously filter noise from sparse logs and Emergent Drift Guard Engine (EDGE) to verify evolving patterns within known fault categories and escalate genuinely novel types for expert registration using LLM-assisted reasoning. Evaluations on two real-world datasets comprising 6,789 and 6,779 KPFault cases demonstrate that PanicGuard achieves high accuracy (0.996 and 0.993) and Macro-F1 score (0.977 and 0.990) with only 29 and 33 human interventions, respectively. Compared to the strongest baseline, PanicGuard reduces human effort by 69% and 95%, respectively, while maintaining high precision. It has been operating in production for over three months, proving its effectiveness in achieving superior diagnostic performance compared to legacy methods, while significantly reducing manual intervention. The source code is publicly available at https://doi.org/10.5281/zenodo.19826984.

@inproceedings{paperbot12592,
  title = {Expanding Guard Reach: Online Learning-Driven Incremental Kernel Panic Diagnosis},
  author = {Yicheng Sui and Xiaotian Wang and Hailin Zhang and Shenglin Zhang and Binhong Jiang and Heng Zheng and Yongqian Sun and Yuzhi Zhang and Yang Zhang and Xin Wu and Liangyan Peng and Linlin Han and Feng Wang and Xiaozhou Liu and Yu Zhang},
  booktitle = {ASE},
  year = {2026},
  doi = {10.1145/3832783.3834474}
}