> The tracee stops and reports PTRACE_EVENT_FORK from do_notify_resume(), > after that syscall_trace_leave() can't (and must not) be called.
Oh, I see what you mean. That is all under your control from the utrace API level. You can use a syscall-exit report first if you want to for keeping track of things, but yes, the actual stop will not be until later. Thanks, Roland
