ENH: more ipset create syscalls in decoding