Add a tiny helper to figure out the last syscall