I noticed a number of "fuser(PID): syscall 37" entries in my dmesg. If 'sflg' is set (i.e., the -k or -s options were specified), fuser might call kill(2) (see fuser.c: 176), otherwise "stdio rpath" is apparently sufficient for fuser.
Index: usr.bin/fstat/fstat.c =================================================================== RCS file: /cvs/src/usr.bin/fstat/fstat.c,v retrieving revision 1.81 diff -u -p -r1.81 fstat.c --- usr.bin/fstat/fstat.c 10 Oct 2015 14:29:05 -0000 1.81 +++ usr.bin/fstat/fstat.c 12 Oct 2015 10:47:19 -0000 @@ -275,8 +275,18 @@ main(int argc, char *argv[]) if ((kf = kvm_getfiles(kd, what, arg, sizeof(*kf), &cnt)) == NULL) errx(1, "%s", kvm_geterr(kd)); - if (pledge("stdio rpath route", NULL) == -1) - err(1, "pledge"); + if (fuser) { + if (sflg) { /* fuser might call kill(2) */ + if (pledge("stdio rpath proc", NULL) == -1) + err(1, "pledge"); + } else { + if (pledge("stdio rpath", NULL) == -1) + err(1, "pledge"); + } + } else { + if (pledge("stdio rpath route", NULL) == -1) + err(1, "pledge"); + } find_splices(kf, cnt); if (!fuser)