Introduce the CTLFLAG_NEEDGIANT flag (modelled after D_NEEDGIANT) that can be used to name and shame sysctls still requiring Giant ;-)
Set CTLFLAG_NEEDGIANT to all SYSCTL_(ADD_)PROCs not marked as MPSAFE.
Mark all SYSCTL_(ADD_)NODEs using custom handler and not already marked as MPSAFE as CTLFLAG_NEEDGIANT.
Mark all various handcrafted SYSCTL_(ADD_)OID etc invocation I've seen in the code.
Add a static_assert to check for one of the now required flags.
Full diff with -U999999 available at https://people.freebsd.org/~kaktus/sysctl.patch because it's getting close to 18MB.
Check kmods in ports?