As announced by JS on the factory mailing list, the lockdown patches have been disabled and kernel-default-6.2.2-4.1.g3a7e162.x86_64 from Kernel:stable works fine again. Closing as fixed.