fix the "is syscall active" check