Eskimo & POM, thanks for your responses --
Yes, the driver is correctly signed (unless something in this process I don't know about has changed since Yosemite). Messing around with kextutil got a working away of loading the module, but I'm not sure why the way we've been doing it is failing:
Previously (from a daemon running as root): "/sbin/kextload -b com.contentwatch.ghoti.NARCPacketInterceptor"
Manually running this on El Capitan results in the following error:
com.contentwatch.ghoti.NARCPacketInterceptor failed to load - (libkern/kext) not found; check the system/kernel logs for errors or try kextutil(8).
(System log says essentailly the same thing: It cannot find com.contentwatch.ghoti.NARCPacketInterceptor)
However, both kextutil and kextload using the path of /Library/Extensions/NARCPacketInterceptor.kext work. The output of kextstat with the module loaded shows the identifier that was being used with -b above:
107 0 0xffffff7f821f3000 0x9000 0x9000 com.contentwatch.ghoti.NARCPacketInterceptor (1) 975B6261-0A61-3DFE-BCB7-D25BB429332E <4 1>
Are we going to have to move to using the path? Is this expected?