[stunt]

Someone here suggested that you could do `csrutil enable --without kext` to load untrusted kernel extension without disabling SIP entirely.