4.6.2 XIJ-Jamie-patch では allow.kmem の変更が確認でき ないので↓を追加

--- sys/kern/kern_jail.c	2016-02-17 09:34:17.000000000 +0900
+++ sys/kern/kern_jail.c	2016-03-07 09:49:17.458004000 +0900
@@ -4313,6 +4336,10 @@
     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
     NULL, PR_ALLOW_MOUNT_ZFS, sysctl_jail_default_allow, "I",
     "Processes in jail can mount the zfs file system");
+SYSCTL_PROC(_security_jail, OID_AUTO, kmem_allowed,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
+    NULL, PR_ALLOW_KMEM, sysctl_jail_default_allow, "I",
+    "Processes in jail can access kmem");
 
 static int
 sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)

• これで，sysctlで確認できる

  root@t:~ # sysctl -a | grep 'jail.*kmem'
  security.jail.param.allow.kmem: 0
  security.jail.kmem_allowed: 0
  root@t:~ # jexec desktop sysctl -a | grep 'jail.*kmem'
  security.jail.param.allow.kmem: 0
  security.jail.kmem_allowed: 1
  root@t:~ #