Change l:orig_cmd to l:orig_cmd_value to distinguish from syscall dict