Made some progress implementing a

kernel_parameters

table before checking for use of

sysctl

revealed

system_controls

already does exactly the same thing. D'oh. On the plus side, this issue should be informational only and not prompt a feature or fix. https://github.com/facebook/osquery/issues/3688