In order to confirm my assumption about this bug, I just reinstalled a clean High Sierra.
After I installed HS, I use clover to totally enable CSR settings(without checking any CSR option in boot parameters), and of course I booted with -nv_disable=1, but no -x option. so at this specific time, I'm booting with CSR enabled and only `-nv_disable=1 -kext-dev-mode=1` as boot option.
then install the webdriver, there would be no error, just need to allow the gatekeeper to run the nvidia extension, and I allowed it, then I can open NVIDIA Driver Manager preference without any problem.
finally, just boot with desired CSR setting and enable nvidia web driver in clover. now I have a fully functional 970.