Oh it's never that easy. It happens 20 layers deep, with configuration set a certain way... only every Friday the 13th. I.e. MacOS is based on UNIX/BSD, root i

Oh it's never that easy. It happens 20 layers deep, with configuration set a certain way... only every Friday the 13th. I.e. MacOS is based on UNIX/BSD, root is all powerfull. So root is disabled form login with <star> password, but it's still there. Then there is the Apple autentication framework on top of that, here root is disabled. But if you try to log in with root, it gets enabled but can't login because password is still <star> an disabled. Then somebody decides new password hashes are safer and we should update old hashes whenever possible. So now when a disabled root account gets enabled, the update routine mishandles <star> password and updates the root password hash with <empty string>.