This doesn't seem right to me. In line 153, an unprotected read of rule_string would be performed, based on the context I believe what you should have done is something like:

	new_string = malloc(MAC_RULE_STRING_LEN, M_DO,
	    M_WAITOK|M_ZERO);
	mtx_lock(&rule_mtx);
	strcpy(new_string, rule_string);
	mtx_unlock(&rule_mtx);

        error = sysctl_handle_string(oidp, new_string, MAC_RULE_STRING_LEN, req);
	if (req->newptr == NULL)
		return (error));

and the error = sysctl_handle_string below should be gone.

We normally place the copyright first and the tag below, cf. https://docs.freebsd.org/en/articles/license-guide/

(no paragraph break needed before a new section)

Please add an EXAMPLES section.

We normally place the copyright first and the tag below, cf. https://docs.freebsd.org/en/articles/license-guide/

needs sorting

Here you unlock ppr while pr is still locked. Technically there's no rule against that but it seems odd.

In every case where you call this with non-null lrp, you unlock pr immediately on return, so why not just unlock it here?

Isn't this redundant? It's global, it will be initialized to all-zeroes by the loader.

See above.

See above.