sendfile64: capture out_fd instead of dropping both fds

sendfile64(out_fd, in_fd, offset, count) transfers bytes between two file
descriptors in the kernel and returns the number of bytes written to out_fd.
Its tracepoint fields carry no field literally named "fd", so it fell through
to KindNull and captured no descriptor at all - inconsistent with its sibling
copy_file_range (KindFd) and the read/write/sendto/recvfrom families.

Add an explicit sys_enter_sendfile64 -> KindFd override that captures out_fd
(args[0], the destination the bytes are written to), matching the single-fd
KindFd convention. The return value stays TransferClassified, consistent with
copy_file_range/splice/tee/vmsplice. Family stays Network (sendfile is
historically socket-oriented; copy_file_range=FS is pure file-to-file).

Update docs/syscall-tracing-plan.md (move sendfile64 from null to fd kind),
regenerate C/Go artifacts, fix the phase-A classify assertion, and add
TestClassifySendfile64CapturesOutFd as a lock-in + negative test. The existing
TestRetbytesPhaseA integration test still passes with the runtime change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 12 insertions, 1 deletions

diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index b7e9c0f..f85cb93 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -246,7 +246,18 @@ var nameOnlyKindsTable = map[string]TracepointKind{
 	// fd_event. This lets the runtime honour the upper bound and the
 	// CLOSE_RANGE_CLOEXEC flag instead of closing every fd >= first.
 	"sys_enter_close_range": KindTwoFd,
-	"sys_enter_statmount":   KindNull,
+	// sendfile64(out_fd, in_fd, offset, count) transfers bytes between two file
+	// descriptors inside the kernel and returns the number of bytes written to
+	// out_fd (TransferClassified, see retClassifications). Its tracepoint fields
+	// (out_fd, in_fd, offset, count) carry no field literally named "fd", so
+	// without an explicit override it would fall through to KindNull and capture
+	// no descriptor at all — unlike its sibling copy_file_range, which is a
+	// KindFd event. Capture out_fd (args[0], the destination the bytes are
+	// written to) so sendfile64 attributes its transfer to a concrete fd, matching
+	// the single-fd KindFd convention used for copy_file_range and the
+	// read/write/sendto/recvfrom families.
+	"sys_enter_sendfile64": KindFd,
+	"sys_enter_statmount":  KindNull,
 	"sys_enter_listmount":   KindNull,
 	"sys_enter_listns":      KindNull,