Sorry, I mixed up spctl and csrutil. SIP state is stored in an NVRAM variable that is a bitfield of what is allowed. You can't change all bits with csrutil, and you can't set the variable from within macOS, both main and recovery. You have to bypass that mechanism by either patching the macOS kernel to allow setting whatever you want, or booting into an OS that doesn't perform these checks in the first place. And you need to set the bit for IIRC kernel debugging for it to honor the `amfi_get_out_of_my_way` argument.
