audit_classify_syscall
extern int audit_classify_syscall(int abi, unsigned syscall);
switch (audit_classify_syscall(ctx->arch, n)) {