BPFLOG_FILTER_MAX
expr = malloc(BPFLOG_FILTER_MAX);
rv = read(fd, expr, BPFLOG_FILTER_MAX);
if (rv >= BPFLOG_FILTER_MAX - 1)
