[kqr]

> I wanted to correlate packets with userspace events from a Python program, so I used a fun trick: Find a syscall which has an early-exit error path and bindings in most languages, and then trace calls to that which have specific arguments which produce an error.

Wow. This is some great engineering. Obviously that's what you'd do, but I'd never think of it in a thousand years!