checksyscalls now checks for lstat