So, as I thought.

Should it then not be sufficient to replace/modify that lib, adapt refhashlist as root and we are good to go in closed (aegis) mode?
Cannot check myself as using open kernel and already applied (without taking care about refhashlist ).