I made a recipe for kconfig-hardened-check-native, copied from the board/qemu config.gz, cmdline.txt, sysctl.txt and ran:

$ oe-run-native kconfig-hardened-check-native kernel-hardening-checker -c /workdir/hardening/config.gz -l /workdir/hardening/cmdline.txt -s /workdir/hardening/sysctl.txt 
Getting sysroot...
[+] Kconfig file to check: /workdir/hardening/config.gz
[+] Kernel cmdline file to check: /workdir/hardening/cmdline.txt
[+] Sysctl output file to check: /workdir/hardening/sysctl.txt
[+] Detected microarchitecture: X86_64
[+] Detected kernel version: (6, 10, 3)
[+] Detected compiler: GCC 140200
[!] WARNING: cmdline option "console" is found multiple times
=========================================================================================================================
              option_name               | type  |desired_val | decision |      reason      | check_result
=========================================================================================================================
...
CONFIG_INIT_ON_ALLOC_DEFAULT_ON         |kconfig|     y      |   kspp   | self_protection  | OK
...
CONFIG_PROC_KCORE                       |kconfig| is not set |   kspp   |cut_attack_surface| OK
...
CONFIG_SECURITY_DMESG_RESTRICT          |kconfig|     y      |   kspp   |cut_attack_surface| OK
...
CONFIG_DEVMEM                           |kconfig| is not set |   kspp   |cut_attack_surface| OK
...
CONFIG_HARDENED_USERCOPY                |kconfig|     y      |   kspp   | self_protection  | OK
...