ZFS slackspace, grepping it for data

[grarpamp]

Say there's a 100GB zpool over a single vdev (one drive).
It's got a few datasets carved out of it.
How best to stroll through only the 10GB of slackspace
(aka: df 'Avail') that is present?
I tried making a zvol out of it but only got 10mb of zeros,
which makes sense because zfs isn't managing anything
written there in that empty zvol yet.
I could troll the entire drive, but that's 10x the data and
I don't really want the current 90gb of data in the results.
There is zdb -R, but I don't know the offsets of the slack,
unless they are somehow tied to the pathname hierarchy.
Any ideas?