About the patch

How about using module context to save the state instead of providing a patch?

something like
# line 188

--if (r->main->sysguard_set) {
++ctx = ngx_http_get_module_ctx(r, ngx_http_sysguard_module);
++if (ctx != NULL || r->internal) {

Start at the module source around line 188 and inspect how the current sysguard state is stored and read. Compare that flow with the proposed module-context approach, then verify the module still handles internal requests and preserves its existing protection behavior.

Written by the indexing model from the issue text.