I'm about to port parts of the qemu kqemu to Darwin. In that matter I had to make a kext using the BSD ioctl API for Border crossing. Apple Documentation considering that topic is a little bit sparse. But in the end I came up with a kext and a test client to access the kext. If You are interested, you can find the kext and the client here: