cherry-pick ssp wrapper, hopefully fixing npfctl with older cc
Source for buildrump.sh git rev 091d3ba4aab8af37452390d933ec31512ebf5382