The ebuild should check that RAP (CONFIG_PAX_RAP) is turned off, since the zavl module does not work with it. The ebuild already checks that PAX_KERNEXEC_PLUGIN_METHOD_OR is turned off, which is the other kernel option that zavl does not work with.
we no longer have hardened-sources and old zfs versions. closing. feel free to reopen if you think this still needs to be fixed somehow. I have access to modern grsec sources and they now supply a patch for zfs to workaround those and other issues.