A stylistic question:

For vmstat (& iostat) we need the values of tk_nin and tk_nout.  Related
values (but not used at the moment) are tk_cancc and tk_rawcc.  Would it
be better to retrieve a single "struct tkstats" that contained all four
members or add a new node and retrieve kern.tkstat.{tk_nin,...} with
separate sysctl calls?

A struct has the advantage of a single syscall for retrieval, vs a more
mib-like feel and might possibly be cleaner for sysctl(8) to display
if it were made a little more general.  I don't really have an opinion
either way with this one...

Simon.