/rescue includes some capsicum-enabled binaries (e.g., ping(8)), but their capsicum integration is disabled. A bit of digging revealed that this is probably the result of symbol name collisions between libnv (a dependency of libcasper) and zfs (which uses an illumos-compatible nvlist API).