According to the cgroup v2 docs, when usage reaches memory.max and cannot be reduced, the OOM killer is invoked in that cgroup, and memory.events counts it in oom_kill.