Support splice

Known issue: filtering works like "fd" is "fd_in", however, it looks like splice is the first syscall here using two fds.