kernel module intercepts and patches syscalls