syscall memory checking