fix(classify): capture timerfd_gettime/settime + splice/tee fd, not KindNull

Root cause: the generic field matcher classifyByField only maps an arg
literally named "fd" to KindFd. Several syscalls operate on an EXISTING
fd whose tracepoint arg0 is named something else, so they fell through
to KindNull -> null_event, capturing NO descriptor and dropping the fd
they act on:

  - timerfd_gettime / timerfd_settime: arg0 is "int ufd" (the timerfd)
  - splice: arg0 is "int fd_in" (source fd of an in-kernel transfer)
  - tee:    arg0 is "int fdin"  (source fd of an in-kernel transfer)

Fix: add explicit KindFd overrides for these four sys_enter_* keys to
nameOnlyKindsTable so the enter handler captures arg0, mirroring the
established epoll_wait(epfd) / mq_*(mqdes) / sendfile64(out_fd) /
copy_file_range(fd_in) precedent. splice/tee were surfaced by a systemic
sweep of tracepoint formats for fd-typed arg0 named other than "fd" that
currently classify to null; they are TransferClassified siblings of
sendfile64/copy_file_range and clearly fd-operating. The *at() family
(dfd arg0) is intentionally untouched: it is path-classified, and
timerfd_create remains the KindEventfd fd CREATOR.

Regenerated artifacts (mage generate): the four enter handlers now emit
fd_event capturing ctx->args[0] instead of null_event; exit handlers stay
UNCLASSIFIED. Updated the generated kind maps, the golden result.txt, the
classify_test expectations, and docs/syscall-tracing-plan.md (moved the
four from kind "null" to kind "fd"; families IPC/Network unchanged).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2 files changed, 23 insertions, 2 deletions

diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 3ba0c00..efc9917 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -202,6 +202,16 @@ var nameOnlyKindsTable = map[string]TracepointKind{
 	"sys_exit_signalfd4":       KindEventfd,
 	"sys_enter_timerfd_create": KindEventfd,
 	"sys_exit_timerfd_create":  KindEventfd,
+	// timerfd_settime/timerfd_gettime operate on an EXISTING timerfd whose
+	// tracepoint arg0 is named "ufd" (int), not literally "fd". The generic
+	// field matcher (classifyByField) only maps fieldName=="fd" -> KindFd, so
+	// without these overrides they fall through to KindNull and capture NO
+	// descriptor — dropping the timerfd they act on. Classify them KindFd so
+	// the enter handler captures the timerfd at args[0], mirroring the
+	// epoll_wait(epfd) and mq_*(mqdes) precedent. timerfd_create above is the
+	// fd CREATOR (KindEventfd) and is intentionally left unchanged.
+	"sys_enter_timerfd_settime": KindFd,
+	"sys_enter_timerfd_gettime": KindFd,
 
 	"sys_enter_epoll_create":  KindEventfd,
 	"sys_exit_epoll_create":   KindEventfd,
@@ -257,6 +267,17 @@ var nameOnlyKindsTable = map[string]TracepointKind{
 	// the single-fd KindFd convention used for copy_file_range and the
 	// read/write/sendto/recvfrom families.
 	"sys_enter_sendfile64": KindFd,
+	// splice(fd_in, off_in, fd_out, off_out, len, flags) and
+	// tee(fdin, fdout, len, flags) are in-kernel transfers between two
+	// EXISTING file descriptors (TransferClassified, see retClassifications),
+	// exactly like copy_file_range/sendfile64. Their arg0 is the source fd
+	// named "fd_in"/"fdin" — not literally "fd" — so the generic field matcher
+	// (classifyByField) leaves them at KindNull, capturing NO descriptor and
+	// dropping the fds they operate on. Classify them KindFd to capture the
+	// source fd at args[0], matching the single-fd KindFd convention already
+	// used for copy_file_range and sendfile64.
+	"sys_enter_splice":     KindFd,
+	"sys_enter_tee":        KindFd,
 	"sys_enter_statmount":  KindNull,
 	"sys_enter_listmount":   KindNull,
 	"sys_enter_listns":      KindNull,
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index 4993293..7d68e40 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -304,8 +304,8 @@ func TestClassifyPhaseAByteSyscallPairsAccepted(t *testing.T) {
 		{"sendto", "struct fd_event", "WRITE_CLASSIFIED"},
 		{"sendmsg", "struct fd_event", "WRITE_CLASSIFIED"},
 		{"sendfile64", "struct fd_event", "TRANSFER_CLASSIFIED"},
-		{"splice", "struct null_event", "TRANSFER_CLASSIFIED"},
-		{"tee", "struct null_event", "TRANSFER_CLASSIFIED"},
+		{"splice", "struct fd_event", "TRANSFER_CLASSIFIED"},
+		{"tee", "struct fd_event", "TRANSFER_CLASSIFIED"},
 		{"process_vm_readv", "struct null_event", "READ_CLASSIFIED"},
 		{"process_vm_writev", "struct null_event", "WRITE_CLASSIFIED"},
 	}