I am trying to read the dirty buffer associated with the vnode. For the life of me I cant figure out how to gain access to it so I can inspect it's content. I am using macOS Sierra 10.12.5 and I've tried to use buf_iterate routine registering a callback to be called to process the dirty buffers. The callback never gets called. My questions is:

1) What's the best method of reading the dirty buffer(s) given a vnode (I am already ensuring I am processing a file vnode)?
2) If buf_iterate is the right API, when is the callback called?
3) What's the best way to inspect a buffer associated with the Vnode in the MAC layer so a proper security decision can be made about the operation at hand?