fix(classify): msgsnd returns status, not bytes — make ret UNCLASSIFIED

msgsnd(2) returns 0 on success or -1 on error; the payload size msgsz is
an INPUT argument, never the return value. It was wrongly listed in
retClassifications as WriteClassified, which made the stats engine treat
its 0 return as "bytes written". Remove it so its return stays
UNCLASSIFIED, consistent with its SysV IPC siblings (msgrcv legitimately
stays ReadClassified because it returns a received byte count).

Regenerated tracepoints/docs accordingly. Verified: mage generate
idempotent, mage build OK, internal/generate tests pass, and the
TestSysVMsgBasic integration test (added in task 7i0) still passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

4 files changed, 9 insertions, 5 deletions

diff --git a/docs/syscall-tracing-plan.md b/docs/syscall-tracing-plan.md
index 822f363..2225d48 100644
--- a/docs/syscall-tracing-plan.md
+++ b/docs/syscall-tracing-plan.md
@@ -94,7 +94,7 @@ Payload bytes classified by return value:
 
 - ReadClassified: `fgetxattr`, `flistxattr`, `getdents`, `getdents64`, `getrandom`, `getxattr`, `getxattrat`, `lgetxattr`, `listxattr`, `listxattrat`, `llistxattr`, `mq_timedreceive`, `msgrcv`, `pread64`, `preadv`, `preadv2`, `process_vm_readv`, `read`, `readlink`, `readlinkat`, `readv`, `recvfrom`, `recvmsg`, `syslog`
 - TransferClassified: `copy_file_range`, `sendfile64`, `splice`, `tee`, `vmsplice`
-- WriteClassified: `mq_timedsend`, `msgsnd`, `process_vm_writev`, `pwrite64`, `pwritev`, `pwritev2`, `sendmsg`, `sendto`, `write`, `writev`
+- WriteClassified: `mq_timedsend`, `process_vm_writev`, `pwrite64`, `pwritev`, `pwritev2`, `sendmsg`, `sendto`, `write`, `writev`
 
 All other traced syscalls are treated as non-bytes for throughput accounting.
 Memory extent is tracked separately via address-space metrics.
diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index 64d40db..8e3f996 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -3296,7 +3296,7 @@ int handle_sys_enter_msgsnd(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_msgsnd is a struct ret_event (WRITE_CLASSIFIED) (kind=ret)
+/// sys_exit_msgsnd is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_msgsnd")
 int handle_sys_exit_msgsnd(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -3316,7 +3316,7 @@ int handle_sys_exit_msgsnd(struct syscall_trace_exit *ctx) {
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
     ev->ret = ctx->ret;
-    ev->ret_type = WRITE_CLASSIFIED;
+    ev->ret_type = UNCLASSIFIED;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt
index e6cb4d3..0a88f30 100644
--- a/internal/c/generated_tracepoints_result.txt
+++ b/internal/c/generated_tracepoints_result.txt
@@ -551,7 +551,7 @@ sys_exit_mseal is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_msgctl is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_msgget is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_msgrcv is a struct ret_event (READ_CLASSIFIED) (kind=ret)
-sys_exit_msgsnd is a struct ret_event (WRITE_CLASSIFIED) (kind=ret)
+sys_exit_msgsnd is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_msync is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_munlock is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_munlockall is a struct ret_event (UNCLASSIFIED) (kind=ret)
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 0735291..c1125e5 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -625,7 +625,11 @@ var retClassifications = map[string]RetClassification{
 	"pwritev2":          WriteClassified,
 	"sendmsg":           WriteClassified,
 	"sendto":            WriteClassified,
-	"msgsnd":            WriteClassified,
+	// msgsnd is deliberately NOT listed here: msgsnd(2) returns 0 on success or
+	// -1 on error — it is NOT a byte count (the payload size msgsz is an INPUT
+	// arg, never the return). Like its SysV IPC siblings (msgrcv excepted, which
+	// genuinely returns a received byte count), msgsnd's int status must stay
+	// UNCLASSIFIED so the stats engine never treats the return as bytes written.
 	"write":             WriteClassified,
 	"writev":            WriteClassified,
 	"mq_timedsend":      WriteClassified,