[saagarjha]

I believe those are the instructions for kernel extensions that are "approved" but distributed by third-parties.

[stunt]

Someone here suggested that you could do `csrutil enable --without kext` to load untrusted kernel extension without disabling SIP entirely.