Once you can get someone to install your kext aren’t you basically at game over anyway?
Or do they have strong limits as well?
Or do they have strong limits as well?
The full fix will require a complete recompile of the full kernel/toolchain, if they can do any kind of microcode update (I have not checked) that allows for mitigation.