How do I repair an ubuntu install with apparmor running forever at startup?

I tried to upgrade an Ubuntu 22.04.2 LTS install to 23.04 last night. Upon reboot, the system will hang trying to start AppArmor. I found a few posts in the past about disabling app armor from starting in recovery mode. I also can't boot into recovery mode (same behavior). I've tried systemd.mask=apparmor.service on grub screen with recovery mode as suggested on old threads with no luck. When I say it hangs, I let it go overnight and it ran for 9 hours with no end in sight.

I was thinking about booting an ubuntu installer on a flash drive and then trying to repair that way. I thought about trying to chroot the file system on the SSD and see if I can cleanup some old apps and make sure everything got updated. Is that the right approach? Is there a way to disable AppArmor from the mounted filesystem so it doesn't startup?

I saw two warnings during the install about samba and ntpd config files recommending a reboot, but nothing else that seemed out of place.

I did have a fair number of snaps and one flatpak installed on this system going into it.

To fix this, I had to boot off the ubuntu installer USB image for 23.04, mount the file system the OS is installed on with sudo mount /dev/nvme0n1p2 /mnt, run chroot /mnt, edit /etc/resolv.conf to add a valid DNS server,

sudo apt update; sudo apt upgrade; sudo apt dist-upgrade

Then I disabled AppArmor sudo systemctl disable apparmor.service

After rebooting, the system came up fine.

I experienced the same. It's stuck in kernel. It creates a bunch of processes like this:

root@lenovo:/home/roman# ps axlwww | grep apparmor
4     0   30504       1  20   0   2732  1664 do_wai Ss   ?          0:00 /bin/sh /lib/apparmor/apparmor.systemd reload
1     0   30513       1  20   0  38444 27520 aa_rep D    ?          0:01 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d
0     0   30677   30504  20   0  11044  1792 do_wai S    ?          0:00 xargs -n1 -0r -P 12 /sbin/apparmor_parser --write-cache --replace --
0     0   30691   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/lsb_release
0     0   30694   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/nvidia_modprobe
1     0   30697   30691  20   0  12420  1668 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/lsb_release
1     0   30700   30694  20   0  12420  1668 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/nvidia_modprobe
0     0   30703   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/sbin.dhclient
1     0   30706   30703  20   0  12552  1796 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/sbin.dhclient
0     0   30709   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.bin.evince
0     0   30712   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.bin.man
1     0   30713   30709  20   0  39812 28004 -      R    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.bin.evince
0     0   30714   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.bin.tcpdump
1     0   30717   30712  20   0  12412  1668 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.bin.man
1     0   30718   30714  20   0  12544  1796 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.bin.tcpdump
0     0   30719   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.ioquake3.ioq3ded
0     0   30723   30677  20   0  12332  3328 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.ioquake3.ioquake3
1     0   30725   30719  20   0  12412  1668 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.ioquake3.ioq3ded
0     0   30726   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.libreoffice.program.oosplash
1     0   30729   30723  20   0  12556  1796 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.ioquake3.ioquake3
0     0   30730   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.libreoffice.program.senddoc
1     0   30733   30726  20   0  12412  1668 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.libreoffice.program.oosplash
1     0   30734   30730  20   0  12412  1668 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.libreoffice.program.senddoc
0     0   30735   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.libreoffice.program.soffice.bin
1     0   30738   30735  20   0  14572  2820 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.libreoffice.program.soffice.bin
0     0   30739   30677  20   0  12332  3200 do_wai S    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.libreoffice.program.xpdfimport
1     0   30744   30739  20   0  12412  1540 aa_rep D    ?          0:00 /sbin/apparmor_parser --write-cache --replace -- /etc/apparmor.d/usr.lib.libreoffice.program.xpdfimport
root@lenovo:/home/roman# cat /proc/30697/wchan
aa_replace_profiles

So it's sleeping on wchan "aa_replace_profiles".