This does work inside of rEFInd, which can load a kernel EFI blob directly, and supply it args.