because nc(1) is only pledged for fork and exec when you explicitly supply something for it to exec?, otherwise it takes codepaths that do not grant that pledge permission.

Having something be capcicumized (?) and exec capable seems to be mutually exclusive.