I don’t have the code in front of me right now but it sounds like osquery’s information is incomplete, meaning it does not expose all of /proc/meminfo. You might need to change the information provided in the memory_info table.

Is there some documentation using which I can easily modify existing osquery tables?