Findings will be included in part II of this blog posting :)
While I wait for a kext signing certificate from Apple I'll going to check this out, as KAuth interface appears more stable than the prototype of the MAC policy function. Update: Several people have reached out to me (mahalo!) to mention that the KAuth API can also be used to monitor process creation from a kext.