We have a pretty strong guarantee that it can only happen once per process...
Index: sys/sys/syscall_mi.h =================================================================== RCS file: /cvs/src/sys/sys/syscall_mi.h,v retrieving revision 1.11 diff -u -p -r1.11 syscall_mi.h --- sys/sys/syscall_mi.h 9 Oct 2015 01:17:18 -0000 1.11 +++ sys/sys/syscall_mi.h 26 Oct 2015 15:13:44 -0000 @@ -72,7 +72,8 @@ mi_syscall(struct proc *p, register_t co if (lock) KERNEL_LOCK(); pledged = (p->p_p->ps_flags & PS_PLEDGE); - if (pledged && !(tval = pledge_check(p, code))) { + if (__predict_false( + pledged && !(tval = pledge_check(p, code)))) { if (!lock) KERNEL_LOCK(); error = pledge_fail(p, EPERM, tval);