Draft 2 of many.
Introduce the CTLFLAG_NEEDGIANT flag (modelled after D_NEEDGIANT) that can be used to name and shame sysctls still requiring Giant ;-)
Mark SYSCTL_STRING*, SYSCTL_OPAQUE* and SYSCTL_STRUCT* as inherently in need of Giant because of how the respective handlers work.
Set CTLFLAG_NEEDGIANT to all SYSCTL_PROCs not marked as MPSAFE.
Mark all SYSCTL_NODEs using custom handler and not already marked as MPSAFE as CTLFLAG_NEEDGIANT.
Mark all SYSCTL_NODEs with NULL handler as MPSAFE.
Check for various handcrafted SYSCTL_OID etc invocation I've seen in the code.
Check kmods in ports?