It may be a better user interface if "-j" automatically did the right thing - limit output to the specified jail for traditional jails, and attach to vnet jails. So after the jail_getid(), a jail_get() or jail_getv() to fetch the jail's vnet parameter. Then the jail_attach() can happen if the vnet is JAIL_SYS_NEW.

That's not quite perfect, as it wouldn't detect a non-vnet jail that's a child of a vnet jail. But it would seamlessly cover the common cases.