ls -lO /private/var/db/

The restricted flag was off (now on):

drwxr-xr-x@ 3 root wheel restricted 96 Apr 22 2022 KernelExtensionManagement

Not sure how this happened - it works now though - appreciate the back and forth to get this resolved.