I've tried similar methods in the past. There is information floating around with boot-args that supposedly ignore the kernel cache, but I think they have been deprecated (perhaps since Yosemite, as per your post). An ongoing project of mine is to get macOS to the command line using as little as possible. I'd custom build a relinked kernel, include basic kexts and either bash or busybox.
If we are getting in to the realms of kernel modification, we may need to wait until the source comes out! When I have some time I might go back to my previous project, but I'm currently working on the "Mojave wants to install to APFS" problem
After I unpacked the LZVN prelinkedkernel, noticing that essentials kexts are around 140, I tried too boot with "kextunload" command as like to create an emergency booting less than a safe mode but over than a recovery mode.
But another doubt pervades me:
mounting the EFI partition there are two .scap files related both to the mac firmware.
In particular there is this path /EFI/APPLE/EXTENSIONS with a 15 mb firmware.scap file
Premised that just mounting EFI partition is dangerous since during spotlight indexing could damage it and only if you are brave, but mainly very very expert can manage this;
Well, since these files are updated on every MacOS major upgrade I associate the things.
When anyone powers up his mac there is the typical chime sound which means every hardware motherboard EFI checks are passed so leads to (holding option key) Startup Manager.
From there can see that (on a laptop in my case but applicable to all macs) all these peripherals are detected and perfectly working:
- internal trackpad and keyboard (aka usb input devices);
- wifi and bluetooth (aka pci express devices I guess even if bluetooth is usb input)
- lets say a standard WXGA graphics not only in greyscale but high colors too (I can verify if using Refit or Refind bootloader)
- usb host controllers (like using a usb drive or external as booting device)
- thunderbolt, ethernet and so on
every these nice stuffs to me handling with that firmware.scap file, that is a compressed kexts container.
So what happens if we copy it from a supported mac? I think the risk of brick or unresponsive Startup Manager becomes very very high. So leave it for now.
In conclusion, I think and almost sure that there is a kind of three-way screening after boot a MacOS system between the firmware.scap, the prelinkedkernel and the S/L/E folder.
Thus forcing a Mojave 10.14 EFI firmware or patching many essentials kexts or a XNU kernel is the minimum requirement for booting on legacy machines. This is my opinion.