Thanks for the review. All three findings are valid. 1. [Medium] nf_hooks_lwtunnel cannot be disabled once enabled, so restoring the original value after a probe failed in --all mode. v2 drops --all and the full /proc/sys/net scan, and documents that only per-netns, restorable sysctls belong in the list.
2. [Medium] The rounding problem applied to sysctls that only --all reached (ms/jiffies conversions). The four remaining sysctls do not round, so find_bound() is not affected for them. 3. [Low] check_kernel_log() now ignores /dev/kmsg records whose facility is not LOG_KERN. v2: https://lore.kernel.org/r/[email protected] pw-bot: cr
