Syscall has semantic meaning, if you are writing a shim layer, only use static instrumentation may break the seccomp garentee for the syscall.
range write after mmap etc. it will be hand made TOCTOU
if you are using dynamic instrumentation, you can use the semantic meaning of syscall to do the right thing.
libcapstone is a dynamic instrumentation tool, it can be used to hook arbritrary assembly. It's better than pin
Essentially, syscall intercept discovered that a straightforward approach is sufficient for 0x80 operations within libc. While I've seen that this method isn't universally effective, it's interesting that it's adequate for its specific needs. They utilize 2-byte trampolines to ensure compatibility with syscall instructions.