Does this help?
Since we are close to release, I'm intentionally making it a seperate
block, and we can trust the compiler's common-subexpression-elimination
to clean it up. If there was a 3rd entry we would make it a switch().
Index: kern_pledge.c
===================================================================
RCS file: /cvs/src/sys/kern/kern_pledge.c,v
diff -u -p -u -r1.319 kern_pledge.c
--- kern_pledge.c 4 Sep 2024 07:45:08 -0000 1.319
+++ kern_pledge.c 23 Sep 2024 21:00:17 -0000
@@ -997,6 +997,11 @@ pledge_sysctl(struct proc *p, int miblen
mib[0] == CTL_MACHDEP && mib[1] == CPU_ID_AA64ISAR0)
return (0);
#endif /* CPU_ID_AA64ISAR0 */
+#ifdef CPU_ID_AA64ISAR1
+ if (miblen == 2 && /* arm64 libcrypto inspects CPU
features */
+ mib[0] == CTL_MACHDEP && mib[1] == CPU_ID_AA64ISAR1)
+ return (0);
+#endif /* CPU_ID_AA64ISAR1 */
snprintf(buf, sizeof(buf), "%s(%d): pledge sysctl %d:",
p->p_p->ps_comm, p->p_p->ps_pid, miblen);
