The current license is this text, which is something of a higher-order license:

This source code is licensed under both the Apache 2.0 license (found in the
LICENSE file in the root directory of this source tree) and the GPLv2 (found
in the COPYING file in the root directory of this source tree).
You may select, at your option, one of the above-listed licenses.

I think the answers to your question are non-osquery-specific:

- Technically, the copyright holder is legally permitted to construct impossible licenses just fine. That's just the problem of the recipient; the copyright holder is breaking no law. But in practice, the fact that no recipient can legally use the software is probably something the authors wish to avoid. I'll say "can't" for convenience, but they legally can make their product impossible to redistribute, or more realistically, stop offering one of the two licenses some day.

- If you want to distribute your work under ALv2, you can't include a GPLv2 library.

- I don't know if you can include an ALv2 library in work distributed under the GPLv2 - I think it's the case that the permission to sublicense copyright in the Apache license imposes no restrictions on how you sublicense it (i.e,. it's not viral), and it's the same as including an ALv2 codebase in a proprietary product. You don't get a patent sublicense, so it's basically MIT with more words, which you can definitely include in a GPLv2 codebase. And you need to keep a copy of the AL around to comply with its clause 4(a). (But this doesn't seem to be the normal interpretation of ALv2 + GPLv2, so I'm curious how I'm wrong and how this interacts with the normal interpretation that ALv2 + proprietary is totally fine just like MIT + proprietary is.)

- You can certainly fork osquery under either license at your choice. GPLv2 certainly doesn't prevent you from licensing it under AL-only. I don't whether lawyers/courts would read "select one of the listed licenses" to mean "and not both"; assuming they don't, GPLv2 doesn't prevent you from also having another valid license to the same code (e.g., dual GPLv2/commercial is a totally valid scheme) and exercising your rights under the terms of that license, including sublicensing under that non-GPLv2 license.

- The build scripts you linked are patching a file that's part of Linux, whose COPYING file begins:

NOTE! This copyright does *not* cover user programs that use kernel
services by normal system calls - this is merely considered normal use
of the kernel, and does *not* fall under the heading of "derived work".

Assuming that to use iptables is to "use kernel services by normal system calls," there is (I think) no copyright asserted in the headers - including headers from the OS has been "normal use of the kernel" since before that copyright statement was written. (If it's not, linking that file was already a problem, under the previous BSD+Patents license.) Also, this is assuming that the only thing it's using from the iptables package is headers copied from the Linux kernel, not code from iptables itself, which I agree would not be usable under ALv2. (And perhaps not licenseable if it's a derivative work, yes.)

One way they could solve this is to say that osquery in general is GPLv2/AL (or BSD+Patents, or some other option that permits a one-way use as GPLv2), but the following source files are GPLv2-only, and if you choose to compile with them the resulting binary is GPLv2-only. But it looks like they don't do this, and they in fact use libiptc, which is GPLv2 with no exceptions/qualifications: https://github.com/facebook/osquery/blob/f6d077cbf7e1f60eef0... So I am as confused as you are!