4 files changed, 51 insertions, 4 deletions
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index ffac1b3..8ad1d58 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -38,6 +38,7 @@ const (
 	KindProc
 	KindBpf
 	KindFutex
+	KindPrctl
 )
 
 func (k TracepointKind) MetadataName() string {
@@ -106,6 +107,8 @@ func (k TracepointKind) MetadataName() string {
 		return "bpf"
 	case KindFutex:
 		return "futex"
+	case KindPrctl:
+		return "prctl"
 	default:
 		return "none"
 	}
@@ -403,6 +406,10 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindFd}, true
 	case "sys_enter_process_mrelease":
 		return ClassificationResult{Kind: KindFd}, true
+	case "sys_enter_wait4":
+		return ClassificationResult{Kind: KindProc}, true
+	case "sys_enter_waitid":
+		return ClassificationResult{Kind: KindProc}, true
 	case "sys_enter_clone":
 		return ClassificationResult{Kind: KindProc}, true
 	case "sys_enter_clone3":
@@ -411,6 +418,14 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindProc}, true
 	case "sys_enter_vfork":
 		return ClassificationResult{Kind: KindProc}, true
+	case "sys_enter_kill":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_prctl":
+		return ClassificationResult{Kind: KindPrctl}, true
+	case "sys_enter_setns":
+		return ClassificationResult{Kind: KindFd}, true
+	case "sys_enter_unshare":
+		return ClassificationResult{Kind: KindNull}, true
 	case "sys_enter_bpf":
 		return ClassificationResult{Kind: KindBpf}, true
 	case "sys_enter_futex":
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index c3c7676..dbc14a0 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -805,6 +805,35 @@ func TestClassifyJ7NameOnlyKinds(t *testing.T) {
 	}
 }
 
+func TestClassifyK7NameOnlyKinds(t *testing.T) {
+	tests := []struct {
+		name string
+		want TracepointKind
+	}{
+		{"sys_enter_wait4", KindProc},
+		{"sys_enter_waitid", KindProc},
+		{"sys_enter_kill", KindNull},
+		{"sys_enter_prctl", KindPrctl},
+		{"sys_enter_setns", KindFd},
+		{"sys_enter_unshare", KindNull},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := ClassifyFormat(&Format{
+				Name: tt.name,
+				ExternalFields: []Field{
+					{Type: "long", Name: "__syscall_nr"},
+					{Type: "long", Name: "arg0"},
+				},
+			})
+			if r.Kind != tt.want {
+				t.Fatalf("%s: got kind %d, want %d", tt.name, r.Kind, tt.want)
+			}
+		})
+	}
+}
+
 func TestClassify67NameOnlyKinds(t *testing.T) {
 	tests := []struct {
 		name string
@@ -1182,10 +1211,10 @@ func TestClassifySwapoff(t *testing.T) {
 	}
 }
 
-func TestClassifyKillRequiresGenerationFallback(t *testing.T) {
+func TestClassifyKillExplicitNull(t *testing.T) {
 	r := classifyFromData(t, FormatKill)
-	if r.Kind != KindNone {
-		t.Errorf("kill: got kind %d, want KindNone before generation fallback", r.Kind)
+	if r.Kind != KindNull {
+		t.Errorf("kill: got kind %d, want KindNull", r.Kind)
 	}
 }
 
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index cf75324..eb3d82a 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -635,6 +635,7 @@ func TestGenerateAllEventTypes(t *testing.T) {
 		{KindProc, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 		{KindBpf, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 		{KindFutex, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
+		{KindPrctl, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 	}
 
 	for _, tt := range tests {
@@ -684,6 +685,7 @@ func TestEventStructNames(t *testing.T) {
 		{KindProc, "null_event"},
 		{KindBpf, "null_event"},
 		{KindFutex, "null_event"},
+		{KindPrctl, "null_event"},
 	}
 
 	for _, tt := range tests {
@@ -702,7 +704,7 @@ func TestEnterReject(t *testing.T) {
 		t.Error("KindNone should be enter-rejected")
 	}
 
-	accepted := []TracepointKind{KindFd, KindOpen, KindMqOpen, KindExec, KindPathname, KindName, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt, KindSocket, KindSocketpair, KindAccept, KindPipe, KindEventfd, KindPidfd, KindEpollCtl, KindTwoFd, KindPoll, KindMem, KindSleep, KindKeyctl, KindPtrace, KindPerfOpen, KindSeccomp, KindModule, KindSysVId, KindSysVOp, KindProc, KindBpf, KindFutex}
+	accepted := []TracepointKind{KindFd, KindOpen, KindMqOpen, KindExec, KindPathname, KindName, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt, KindSocket, KindSocketpair, KindAccept, KindPipe, KindEventfd, KindPidfd, KindEpollCtl, KindTwoFd, KindPoll, KindMem, KindSleep, KindKeyctl, KindPtrace, KindPerfOpen, KindSeccomp, KindModule, KindSysVId, KindSysVOp, KindProc, KindBpf, KindFutex, KindPrctl}
 	for _, k := range accepted {
 		if isEnterRejected(k) {
 			t.Errorf("kind %d should NOT be enter-rejected", k)
diff --git a/internal/generate/kindregistry.go b/internal/generate/kindregistry.go
index 03977a4..21cdd35 100644
--- a/internal/generate/kindregistry.go
+++ b/internal/generate/kindregistry.go
@@ -48,6 +48,7 @@ var kindRegistry = map[TracepointKind]kindMeta{
 	KindProc:           {structName: "null_event", enterAccepted: true},
 	KindBpf:            {structName: "null_event", enterAccepted: true},
 	KindFutex:          {structName: "null_event", enterAccepted: true},
+	KindPrctl:          {structName: "null_event", enterAccepted: true},
 	// KindNone is intentionally absent: it represents "unclassified" and is
 	// never enter-accepted. lookupKind returns the zero kindMeta (enterAccepted=false)
 	// for any unregistered kind, so KindNone is implicitly rejected.