j6: account bytes for ret-classified syscalls

1 files changed, 8 insertions, 3 deletions

diff --git a/internal/eventloop_exit.go b/internal/eventloop_exit.go
index 79c1b5b..a0cc675 100644
--- a/internal/eventloop_exit.go
+++ b/internal/eventloop_exit.go
@@ -109,9 +109,6 @@ func (e *eventLoop) handleFdExit(ep *event.Pair, fdEv *types.FdEvent) bool {
 	if ok := e.applyFdTransferOp(ep, fdEv); !ok {
 		return false
 	}
-	if retEv, ok := ep.ExitEv.(*types.RetEvent); ok {
-		ep.Bytes = bytesFromRet(retEv)
-	}
 	return true
 }
 
@@ -315,6 +312,14 @@ func (e *eventLoop) recyclePair(ep *event.Pair, warning string) {
 	ep.Recycle()
 }
 
+func applyRetBytes(ep *event.Pair) {
+	retEv, ok := ep.ExitEv.(*types.RetEvent)
+	if !ok {
+		return
+	}
+	ep.Bytes = bytesFromRet(retEv)
+}
+
 // dropMalformedRawEvent records a warning when a raw BPF event cannot be
 // decoded, keeping the error visible without crashing the event loop.
 func (e *eventLoop) dropMalformedRawEvent(evType types.EventType, raw []byte) {