use syscallrecord struct in splice sanitize