From 3ec3c117bb280a377fea1a3eef84a70e2a3d4150 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Sat, 21 Feb 2026 22:03:57 +0200
Subject: Split ioworkload scenarios.go into per-category files

Split the 2494-line scenarios.go monolith into 14 focused files by
syscall category: open, readwrite, close, dup, fcntl, rename, link,
unlink, dir, stat, sync, truncate, iouring, plus the slimmed-down
scenarios.go containing only the registry map, makeTempDir, and crash.

Extracted rawLink, rawSymlink, rawReadlink helpers in scenario_link.go
to reduce code duplication in linkBasic.

Task: #349 (Go best practices: split oversized scenarios file)
Amp-Thread-ID: https://ampcode.com/threads/T-019c81c6-e1b6-747a-9144-40f6be997e60
Co-authored-by: Amp <amp@ampcode.com>
---
 integrationtests/cmd/ioworkload/scenario_close.go  |  114 +
 integrationtests/cmd/ioworkload/scenario_dir.go    |  186 ++
 integrationtests/cmd/ioworkload/scenario_dup.go    |  151 ++
 integrationtests/cmd/ioworkload/scenario_fcntl.go  |  129 ++
 .../cmd/ioworkload/scenario_iouring.go             |  129 ++
 integrationtests/cmd/ioworkload/scenario_link.go   |  385 ++++
 integrationtests/cmd/ioworkload/scenario_open.go   |  228 ++
 .../cmd/ioworkload/scenario_readwrite.go           |  263 +++
 integrationtests/cmd/ioworkload/scenario_rename.go |  251 ++
 integrationtests/cmd/ioworkload/scenario_stat.go   |  274 +++
 integrationtests/cmd/ioworkload/scenario_sync.go   |  108 +
 .../cmd/ioworkload/scenario_truncate.go            |   89 +
 integrationtests/cmd/ioworkload/scenario_unlink.go |  185 ++
 integrationtests/cmd/ioworkload/scenarios.go       | 2386 --------------------
 14 files changed, 2492 insertions(+), 2386 deletions(-)
 create mode 100644 integrationtests/cmd/ioworkload/scenario_close.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_dir.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_dup.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_fcntl.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_iouring.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_link.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_open.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_readwrite.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_rename.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_stat.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_sync.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_truncate.go
 create mode 100644 integrationtests/cmd/ioworkload/scenario_unlink.go

diff --git a/integrationtests/cmd/ioworkload/scenario_close.go b/integrationtests/cmd/ioworkload/scenario_close.go
new file mode 100644
index 0000000..a36160a
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_close.go
@@ -0,0 +1,114 @@
+package main
+
+import (
+	"fmt"
+	"path/filepath"
+	"syscall"
+)
+
+const sysCloseRange = 436
+
+// closeBasic opens multiple files and closes them.
+func closeBasic() error {
+	dir, cleanup, err := makeTempDir("close-basic")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	var fds []int
+	for i := range 3 {
+		path := filepath.Join(dir, fmt.Sprintf("closefile-%d.txt", i))
+		fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+		if err != nil {
+			return fmt.Errorf("open %d: %w", i, err)
+		}
+		fds = append(fds, fd)
+	}
+	for _, fd := range fds {
+		if err := syscall.Close(fd); err != nil {
+			return fmt.Errorf("close fd %d: %w", fd, err)
+		}
+	}
+	return nil
+}
+
+// closeRange opens multiple files and closes a range of them via close_range(2).
+func closeRange() error {
+	dir, cleanup, err := makeTempDir("close-range")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	var fds []int
+	for i := range 3 {
+		path := filepath.Join(dir, fmt.Sprintf("closerangefile-%d.txt", i))
+		fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+		if err != nil {
+			return fmt.Errorf("open %d: %w", i, err)
+		}
+		fds = append(fds, fd)
+	}
+
+	if fds[2]-fds[0] != 2 {
+		return fmt.Errorf("fds not contiguous: %v", fds)
+	}
+
+	first := uintptr(fds[0])
+	last := uintptr(fds[len(fds)-1])
+	_, _, errno := syscall.Syscall(sysCloseRange, first, last, 0)
+	if errno != 0 {
+		return fmt.Errorf("close_range: %w", errno)
+	}
+	return nil
+}
+
+// closeInvalidFd attempts to close a very high fd number that is not open.
+// The close fails with EBADF, but ior should capture the enter_close tracepoint
+// because arguments are read on syscall entry before the kernel returns an error.
+func closeInvalidFd() error {
+	err := syscall.Close(99999)
+	if err == nil {
+		return fmt.Errorf("expected close of invalid fd to fail")
+	}
+	return nil
+}
+
+// closeDoubleClose opens a file, closes it normally, then closes the same fd again.
+// The second close fails with EBADF, but ior should capture both enter_close
+// tracepoints because arguments are read on syscall entry.
+func closeDoubleClose() error {
+	dir, cleanup, err := makeTempDir("close-double-close")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "doubleclosefile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("first close: %w", err)
+	}
+
+	err = syscall.Close(fd)
+	if err == nil {
+		return fmt.Errorf("expected second close of same fd to fail")
+	}
+	return nil
+}
+
+// closeRangeEmpty calls close_range(2) with a range of very high fd numbers
+// (9000–9999) where no fds are open. The syscall succeeds (empty range is valid),
+// and ior should capture the enter_close_range tracepoint.
+func closeRangeEmpty() error {
+	_, _, errno := syscall.Syscall(sysCloseRange, 9000, 9999, 0)
+	if errno != 0 {
+		return fmt.Errorf("close_range: %w", errno)
+	}
+	return nil
+}
diff --git a/integrationtests/cmd/ioworkload/scenario_dir.go b/integrationtests/cmd/ioworkload/scenario_dir.go
new file mode 100644
index 0000000..0c48d54
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_dir.go
@@ -0,0 +1,186 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"syscall"
+	"unsafe"
+)
+
+// dirBasic creates a directory via raw SYS_MKDIR, checks access, then removes it
+// via raw SYS_RMDIR. We use raw syscalls because Go's syscall.Mkdir wraps mkdirat
+// and syscall.Rmdir wraps unlinkat on amd64.
+func dirBasic() error {
+	dir, cleanup, err := makeTempDir("dir-basic")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	subDir := filepath.Join(dir, "subdir")
+	pathBytes, err := syscall.BytePtrFromString(subDir)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	_, _, errno := syscall.Syscall(syscall.SYS_MKDIR, uintptr(unsafe.Pointer(pathBytes)), 0o755, 0)
+	runtime.KeepAlive(pathBytes)
+	if errno != 0 {
+		return fmt.Errorf("mkdir: %w", errno)
+	}
+
+	if err := syscall.Access(subDir, syscall.F_OK); err != nil {
+		return fmt.Errorf("access: %w", err)
+	}
+
+	pathBytes2, err := syscall.BytePtrFromString(subDir)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	_, _, errno = syscall.Syscall(syscall.SYS_RMDIR, uintptr(unsafe.Pointer(pathBytes2)), 0, 0)
+	runtime.KeepAlive(pathBytes2)
+	if errno != 0 {
+		return fmt.Errorf("rmdir: %w", errno)
+	}
+	return nil
+}
+
+// dirMkdirat creates a directory via mkdirat(2) using Go's syscall.Mkdir
+// which wraps mkdirat with AT_FDCWD on amd64.
+func dirMkdirat() error {
+	dir, cleanup, err := makeTempDir("dir-mkdirat")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	subDir := filepath.Join(dir, "mkdirat-subdir")
+	if err := syscall.Mkdir(subDir, 0o755); err != nil {
+		return fmt.Errorf("mkdirat: %w", err)
+	}
+	return nil
+}
+
+// dirChdir creates a temp directory, then changes to it via chdir(2).
+// Restores the original working directory afterward.
+func dirChdir() error {
+	origDir, err := os.Getwd()
+	if err != nil {
+		return fmt.Errorf("getwd: %w", err)
+	}
+
+	dir, cleanup, err := makeTempDir("dir-chdir")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+	defer syscall.Chdir(origDir)
+
+	if err := syscall.Chdir(dir); err != nil {
+		return fmt.Errorf("chdir: %w", err)
+	}
+	return nil
+}
+
+// dirGetdents opens a directory and reads its entries via getdents64(2).
+func dirGetdents() error {
+	dir, cleanup, err := makeTempDir("dir-getdents")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	// Create a file so getdents has something to return.
+	filePath := filepath.Join(dir, "getdents-file.txt")
+	fd, err := syscall.Open(filePath, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open file: %w", err)
+	}
+	syscall.Close(fd)
+
+	dirFD, err := syscall.Open(dir, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	if err != nil {
+		return fmt.Errorf("open dir: %w", err)
+	}
+	defer syscall.Close(dirFD)
+
+	buf := make([]byte, 4096)
+	_, _, errno := syscall.Syscall(syscall.SYS_GETDENTS64, uintptr(dirFD), uintptr(unsafe.Pointer(&buf[0])), uintptr(len(buf)))
+	runtime.KeepAlive(buf)
+	if errno != 0 {
+		return fmt.Errorf("getdents64: %w", errno)
+	}
+	return nil
+}
+
+// dirMkdirEexist attempts to create a directory that already exists via raw
+// SYS_MKDIR. The syscall fails with EEXIST, but ior captures the tracepoint
+// on entry.
+func dirMkdirEexist() error {
+	dir, cleanup, err := makeTempDir("dir-mkdir-eexist")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	subDir := filepath.Join(dir, "mkdir-eexist-subdir")
+	pathBytes, err := syscall.BytePtrFromString(subDir)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+
+	// Create the directory first so the second attempt fails.
+	_, _, errno := syscall.Syscall(syscall.SYS_MKDIR, uintptr(unsafe.Pointer(pathBytes)), 0o755, 0)
+	runtime.KeepAlive(pathBytes)
+	if errno != 0 {
+		return fmt.Errorf("first mkdir: %w", errno)
+	}
+
+	// Second mkdir on the same path should fail with EEXIST.
+	pathBytes2, err := syscall.BytePtrFromString(subDir)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	_, _, errno = syscall.Syscall(syscall.SYS_MKDIR, uintptr(unsafe.Pointer(pathBytes2)), 0o755, 0)
+	runtime.KeepAlive(pathBytes2)
+	if errno == 0 {
+		return fmt.Errorf("expected EEXIST, but mkdir succeeded")
+	}
+	return nil
+}
+
+// dirChdirEnoent attempts to change to a nonexistent directory via raw
+// SYS_CHDIR. The syscall fails with ENOENT, but ior captures the tracepoint
+// on entry.
+func dirChdirEnoent() error {
+	dir, cleanup, err := makeTempDir("dir-chdir-enoent")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	badPath := filepath.Join(dir, "chdir-enoent-missing")
+	pathBytes, err := syscall.BytePtrFromString(badPath)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	_, _, errno := syscall.Syscall(syscall.SYS_CHDIR, uintptr(unsafe.Pointer(pathBytes)), 0, 0)
+	runtime.KeepAlive(pathBytes)
+	if errno == 0 {
+		return fmt.Errorf("expected ENOENT, but chdir succeeded")
+	}
+	return nil
+}
+
+// dirGetdentsEbadf calls getdents64(2) with an invalid file descriptor.
+// The syscall fails with EBADF, but ior captures the tracepoint on entry.
+func dirGetdentsEbadf() error {
+	buf := make([]byte, 4096)
+	_, _, errno := syscall.Syscall(syscall.SYS_GETDENTS64, uintptr(9999), uintptr(unsafe.Pointer(&buf[0])), uintptr(len(buf)))
+	runtime.KeepAlive(buf)
+	if errno == 0 {
+		return fmt.Errorf("expected EBADF, but getdents64 succeeded")
+	}
+	return nil
+}
diff --git a/integrationtests/cmd/ioworkload/scenario_dup.go b/integrationtests/cmd/ioworkload/scenario_dup.go
new file mode 100644
index 0000000..6a89970
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_dup.go
@@ -0,0 +1,151 @@
+package main
+
+import (
+	"fmt"
+	"path/filepath"
+	"syscall"
+)
+
+// dupBasic opens a file, dups the fd, writes via the dup, closes both.
+func dupBasic() error {
+	dir, cleanup, err := makeTempDir("dup-basic")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "dupfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	newFd, err := syscall.Dup(fd)
+	if err != nil {
+		return fmt.Errorf("dup: %w", err)
+	}
+	defer syscall.Close(newFd)
+
+	if _, err := syscall.Write(newFd, []byte("via dup")); err != nil {
+		return fmt.Errorf("write via dup: %w", err)
+	}
+	return nil
+}
+
+// dupDup2 opens a file and duplicates the fd onto a specific target fd via dup2.
+func dupDup2() error {
+	dir, cleanup, err := makeTempDir("dup-dup2")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "dup2file.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	// Use a high fd number to avoid collisions.
+	targetFd := 500
+	if err := syscall.Dup2(fd, targetFd); err != nil {
+		return fmt.Errorf("dup2: %w", err)
+	}
+	defer syscall.Close(targetFd)
+
+	if _, err := syscall.Write(targetFd, []byte("via dup2")); err != nil {
+		return fmt.Errorf("write via dup2: %w", err)
+	}
+	return nil
+}
+
+// dupDup3 opens a file and duplicates the fd onto a specific target fd via dup3
+// with O_CLOEXEC flag.
+func dupDup3() error {
+	dir, cleanup, err := makeTempDir("dup-dup3")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "dup3file.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	// Use a high fd number to avoid collisions.
+	targetFd := 501
+	if err := syscall.Dup3(fd, targetFd, syscall.O_CLOEXEC); err != nil {
+		return fmt.Errorf("dup3: %w", err)
+	}
+	defer syscall.Close(targetFd)
+
+	if _, err := syscall.Write(targetFd, []byte("via dup3")); err != nil {
+		return fmt.Errorf("write via dup3: %w", err)
+	}
+	return nil
+}
+
+// dupInvalidFd attempts to dup a very high invalid fd number.
+// The syscall fails with EBADF, but ior should capture the enter_dup
+// tracepoint because arguments are read on syscall entry.
+func dupInvalidFd() error {
+	_, err := syscall.Dup(99999)
+	if err == nil {
+		return fmt.Errorf("expected dup of invalid fd to fail")
+	}
+	return nil
+}
+
+// dup2SameFd calls dup2 with the same fd for both oldfd and newfd.
+// Per POSIX, dup2(fd, fd) is a no-op that returns fd without closing
+// and reopening. ior should capture the enter_dup2 tracepoint.
+func dup2SameFd() error {
+	dir, cleanup, err := makeTempDir("dup2-same-fd")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "dup2samefile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	if err := syscall.Dup2(fd, fd); err != nil {
+		return fmt.Errorf("dup2 same fd: %w", err)
+	}
+	return nil
+}
+
+// dup3InvalidFlags calls dup3 with an invalid flags value.
+// dup3 only accepts O_CLOEXEC; any other flag causes EINVAL.
+// ior should capture the enter_dup3 tracepoint.
+func dup3InvalidFlags() error {
+	dir, cleanup, err := makeTempDir("dup3-invalid-flags")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "dup3flagsfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	targetFd := 502
+	_, _, errno := syscall.Syscall(syscall.SYS_DUP3, uintptr(fd), uintptr(targetFd), 0xBAD)
+	if errno == 0 {
+		syscall.Close(targetFd)
+		return fmt.Errorf("expected dup3 with invalid flags to fail")
+	}
+	return nil
+}
diff --git a/integrationtests/cmd/ioworkload/scenario_fcntl.go b/integrationtests/cmd/ioworkload/scenario_fcntl.go
new file mode 100644
index 0000000..0d8e642
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_fcntl.go
@@ -0,0 +1,129 @@
+package main
+
+import (
+	"fmt"
+	"path/filepath"
+	"syscall"
+)
+
+// fcntlDupfd uses fcntl F_DUPFD to duplicate a file descriptor.
+func fcntlDupfd() error {
+	dir, cleanup, err := makeTempDir("fcntl-dupfd")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "fcntlfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	newFd, _, errno := syscall.Syscall(syscall.SYS_FCNTL, uintptr(fd), syscall.F_DUPFD, 0)
+	if errno != 0 {
+		return fmt.Errorf("fcntl F_DUPFD: %w", errno)
+	}
+	defer syscall.Close(int(newFd))
+
+	if _, err := syscall.Write(int(newFd), []byte("via fcntl")); err != nil {
+		return fmt.Errorf("write via fcntl dup: %w", err)
+	}
+	return nil
+}
+
+// fcntlSetfl uses fcntl F_GETFL/F_SETFL to read and modify file status flags.
+func fcntlSetfl() error {
+	dir, cleanup, err := makeTempDir("fcntl-setfl")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "fcntlsetflfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	flags, _, errno := syscall.Syscall(syscall.SYS_FCNTL, uintptr(fd), syscall.F_GETFL, 0)
+	if errno != 0 {
+		return fmt.Errorf("fcntl F_GETFL: %w", errno)
+	}
+
+	_, _, errno = syscall.Syscall(syscall.SYS_FCNTL, uintptr(fd), syscall.F_SETFL, flags|syscall.O_APPEND)
+	if errno != 0 {
+		return fmt.Errorf("fcntl F_SETFL: %w", errno)
+	}
+
+	if _, err := syscall.Write(fd, []byte("appended via fcntl setfl")); err != nil {
+		return fmt.Errorf("write: %w", err)
+	}
+	return nil
+}
+
+// fcntlDupfdCloexec uses fcntl F_DUPFD_CLOEXEC to duplicate a file descriptor
+// with the close-on-exec flag set.
+func fcntlDupfdCloexec() error {
+	dir, cleanup, err := makeTempDir("fcntl-dupfd-cloexec")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "fcntlcloexecfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	newFd, _, errno := syscall.Syscall(syscall.SYS_FCNTL, uintptr(fd), syscall.F_DUPFD_CLOEXEC, 0)
+	if errno != 0 {
+		return fmt.Errorf("fcntl F_DUPFD_CLOEXEC: %w", errno)
+	}
+	defer syscall.Close(int(newFd))
+
+	if _, err := syscall.Write(int(newFd), []byte("via fcntl dupfd cloexec")); err != nil {
+		return fmt.Errorf("write via fcntl dup cloexec: %w", err)
+	}
+	return nil
+}
+
+// fcntlInvalidFd calls fcntl F_GETFL on an invalid fd (99999).
+// The syscall fails with EBADF, but ior should capture the enter_fcntl
+// tracepoint because it is recorded on syscall entry.
+func fcntlInvalidFd() error {
+	_, _, errno := syscall.Syscall(syscall.SYS_FCNTL, 99999, syscall.F_GETFL, 0)
+	if errno == 0 {
+		return fmt.Errorf("expected fcntl on invalid fd to fail")
+	}
+	return nil
+}
+
+// fcntlDupfdMax opens a file and calls fcntl F_DUPFD with a minfd value
+// that exceeds the process RLIMIT_NOFILE. The kernel rejects this with
+// EINVAL, but ior should capture the enter_fcntl tracepoint.
+func fcntlDupfdMax() error {
+	dir, cleanup, err := makeTempDir("fcntl-dupfd-max")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "fcntldupfdmaxfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	// Use a minfd far beyond any realistic RLIMIT_NOFILE.
+	_, _, errno := syscall.Syscall(syscall.SYS_FCNTL, uintptr(fd), syscall.F_DUPFD, 1<<30)
+	if errno == 0 {
+		return fmt.Errorf("expected fcntl F_DUPFD with extreme minfd to fail")
+	}
+	return nil
+}
diff --git a/integrationtests/cmd/ioworkload/scenario_iouring.go b/integrationtests/cmd/ioworkload/scenario_iouring.go
new file mode 100644
index 0000000..b1aac4e
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_iouring.go
@@ -0,0 +1,129 @@
+package main
+
+import (
+	"fmt"
+	"runtime"
+	"syscall"
+	"unsafe"
+)
+
+const (
+	sysIoUringSetup    = 425
+	sysIoUringEnter    = 426
+	sysIoUringRegister = 427
+
+	// io_uring_params struct size: 10 x uint32 + io_sqring_offsets(40) + io_cqring_offsets(40) = 120 bytes.
+	ioUringParamsSize = 120
+
+	ioringRegisterProbe = 8 // IORING_REGISTER_PROBE
+)
+
+// iouringSetup creates an io_uring instance via io_uring_setup(2) and closes the fd.
+func iouringSetup() error {
+	fd, err := ioUringSetupRing(1)
+	if err != nil {
+		return err
+	}
+	return syscall.Close(fd)
+}
+
+// iouringEnter creates an io_uring instance, then calls io_uring_enter(2)
+// with zero submissions/completions to exercise the enter tracepoint.
+func iouringEnter() error {
+	fd, err := ioUringSetupRing(1)
+	if err != nil {
+		return err
+	}
+	defer syscall.Close(fd)
+
+	_, _, errno := syscall.Syscall6(
+		sysIoUringEnter,
+		uintptr(fd),
+		0, // to_submit
+		0, // min_complete
+		0, // flags
+		0, // sig
+		0, // sz
+	)
+	if errno != 0 {
+		return fmt.Errorf("io_uring_enter: %w", errno)
+	}
+	return nil
+}
+
+// iouringRegister creates an io_uring instance, then calls io_uring_register(2)
+// with IORING_REGISTER_PROBE to exercise the register tracepoint.
+func iouringRegister() error {
+	fd, err := ioUringSetupRing(1)
+	if err != nil {
+		return err
+	}
+	defer syscall.Close(fd)
+
+	// io_uring_probe header is 16 bytes; we don't need probe_op entries.
+	var probeBuf [16]byte
+	_, _, errno := syscall.Syscall6(
+		sysIoUringRegister,
+		uintptr(fd),
+		ioringRegisterProbe,
+		uintptr(unsafe.Pointer(&probeBuf[0])),
+		0, // nr_args (0 ops requested)
+		0, 0,
+	)
+	runtime.KeepAlive(probeBuf)
+	if errno != 0 {
+		return fmt.Errorf("io_uring_register: %w", errno)
+	}
+	return nil
+}
+
+// iouringEnterEbadf calls io_uring_enter on an invalid fd.
+// The syscall fails with EBADF, but ior captures the enter_io_uring_enter tracepoint.
+func iouringEnterEbadf() error {
+	_, _, errno := syscall.Syscall6(
+		sysIoUringEnter,
+		99999, // invalid fd
+		0,     // to_submit
+		0,     // min_complete
+		0,     // flags
+		0,     // sig
+		0,     // sz
+	)
+	if errno == 0 {
+		return fmt.Errorf("expected EBADF, but io_uring_enter succeeded")
+	}
+	return nil
+}
+
+// iouringRegisterEbadf calls io_uring_register on an invalid fd.
+// The syscall fails with EBADF, but ior captures the enter_io_uring_register tracepoint.
+func iouringRegisterEbadf() error {
+	_, _, errno := syscall.Syscall6(
+		sysIoUringRegister,
+		99999, // invalid fd
+		ioringRegisterProbe,
+		0, // arg (NULL)
+		0, // nr_args
+		0, 0,
+	)
+	if errno == 0 {
+		return fmt.Errorf("expected EBADF, but io_uring_register succeeded")
+	}
+	return nil
+}
+
+// ioUringSetupRing calls io_uring_setup(2) and returns the ring fd.
+func ioUringSetupRing(entries uint32) (int, error) {
+	var params [ioUringParamsSize]byte
+	fd, _, errno := syscall.Syscall(
+		sysIoUringSetup,
+		uintptr(entries),
+		uintptr(unsafe.Pointer(&params[0])),
+		0,
+	)
+	runtime.KeepAlive(params)
+	if errno != 0 {
+		return 0, fmt.Errorf("io_uring_setup: %w", errno)
+	}
+	return int(fd), nil
+}
diff --git a/integrationtests/cmd/ioworkload/scenario_link.go b/integrationtests/cmd/ioworkload/scenario_link.go
new file mode 100644
index 0000000..bb16984
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_link.go
@@ -0,0 +1,385 @@
+package main
+
+import (
+	"fmt"
+	"path/filepath"
+	"runtime"
+	"syscall"
+	"unsafe"
+)
+
+// linkBasic creates a file, hard links it via link(2), symlinks it via
+// symlink(2), and reads the symlink via readlink(2).
+// Uses raw SYS_LINK, SYS_SYMLINK, SYS_READLINK because Go's syscall wrappers
+// delegate to linkat/symlinkat/readlinkat on amd64.
+func linkBasic() error {
+	dir, cleanup, err := makeTempDir("link-basic")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	origPath := filepath.Join(dir, "original.txt")
+	fd, err := syscall.Open(origPath, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+
+	if err := rawLink(origPath, filepath.Join(dir, "hardlink.txt")); err != nil {
+		return err
+	}
+
+	symPath := filepath.Join(dir, "symlink.txt")
+	if err := rawSymlink(origPath, symPath); err != nil {
+		return err
+	}
+
+	return rawReadlink(symPath)
+}
+
+// linkLinkat creates a file and hard links it via linkat(2).
+func linkLinkat() error {
+	dir, cleanup, err := makeTempDir("link-linkat")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	origName := "linkat-original.txt"
+	origPath := filepath.Join(dir, origName)
+	fd, err := syscall.Open(origPath, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+
+	dirFD, err := syscall.Open(dir, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	if err != nil {
+		return fmt.Errorf("open dir: %w", err)
+	}
+	defer syscall.Close(dirFD)
+
+	hardName := "linkat-hard.txt"
+	oldBytes, err := syscall.BytePtrFromString(origName)
+	if err != nil {
+		return fmt.Errorf("old name bytes: %w", err)
+	}
+	newBytes, err := syscall.BytePtrFromString(hardName)
+	if err != nil {
+		return fmt.Errorf("new name bytes: %w", err)
+	}
+
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_LINKAT,
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(oldBytes)),
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(newBytes)),
+		0, // flags
+		0,
+	)
+	runtime.KeepAlive(oldBytes)
+	runtime.KeepAlive(newBytes)
+	if errno != 0 {
+		return fmt.Errorf("linkat: %w", errno)
+	}
+	return nil
+}
+
+// linkSymlinkat creates a symlink via symlinkat(2).
+func linkSymlinkat() error {
+	dir, cleanup, err := makeTempDir("link-symlinkat")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	origPath := filepath.Join(dir, "symlinkat-original.txt")
+	fd, err := syscall.Open(origPath, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+
+	dirFD, err := syscall.Open(dir, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	if err != nil {
+		return fmt.Errorf("open dir: %w", err)
+	}
+	defer syscall.Close(dirFD)
+
+	targetBytes, err := syscall.BytePtrFromString(origPath)
+	if err != nil {
+		return fmt.Errorf("target bytes: %w", err)
+	}
+	linkName := "symlinkat-link.txt"
+	linkBytes, err := syscall.BytePtrFromString(linkName)
+	if err != nil {
+		return fmt.Errorf("link name bytes: %w", err)
+	}
+
+	_, _, errno := syscall.Syscall(
+		syscall.SYS_SYMLINKAT,
+		uintptr(unsafe.Pointer(targetBytes)),
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(linkBytes)),
+	)
+	runtime.KeepAlive(targetBytes)
+	runtime.KeepAlive(linkBytes)
+	if errno != 0 {
+		return fmt.Errorf("symlinkat: %w", errno)
+	}
+	return nil
+}
+
+// linkReadlinkat creates a symlink, then reads it via readlinkat(2).
+func linkReadlinkat() error {
+	dir, cleanup, err := makeTempDir("link-readlinkat")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	origPath := filepath.Join(dir, "readlinkat-original.txt")
+	fd, err := syscall.Open(origPath, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+
+	// Create symlink using raw SYS_SYMLINK so we don't mix tracepoints.
+	linkPath := filepath.Join(dir, "readlinkat-link.txt")
+	if err := rawSymlink(origPath, linkPath); err != nil {
+		return err
+	}
+
+	// Read via readlinkat(2).
+	dirFD, err := syscall.Open(dir, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	if err != nil {
+		return fmt.Errorf("open dir: %w", err)
+	}
+	defer syscall.Close(dirFD)
+
+	linkName := "readlinkat-link.txt"
+	nameBytes, err := syscall.BytePtrFromString(linkName)
+	if err != nil {
+		return fmt.Errorf("link name bytes: %w", err)
+	}
+	buf := make([]byte, 256)
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_READLINKAT,
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(nameBytes)),
+		uintptr(unsafe.Pointer(&buf[0])),
+		uintptr(len(buf)),
+		0, 0,
+	)
+	runtime.KeepAlive(nameBytes)
+	runtime.KeepAlive(buf)
+	if errno != 0 {
+		return fmt.Errorf("readlinkat: %w", errno)
+	}
+	return nil
+}
+
+// linkEnoent attempts to hard link a nonexistent source via raw SYS_LINK.
+// The syscall fails with ENOENT, but ior captures the enter_link tracepoint
+// because arguments are read on syscall entry.
+func linkEnoent() error {
+	dir, cleanup, err := makeTempDir("link-enoent")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	srcPath := filepath.Join(dir, "link-enoent-missing.txt")
+	dstPath := filepath.Join(dir, "link-enoent-dst.txt")
+
+	srcBytes, err := syscall.BytePtrFromString(srcPath)
+	if err != nil {
+		return fmt.Errorf("src path bytes: %w", err)
+	}
+	dstBytes, err := syscall.BytePtrFromString(dstPath)
+	if err != nil {
+		return fmt.Errorf("dst path bytes: %w", err)
+	}
+
+	_, _, errno := syscall.Syscall(
+		syscall.SYS_LINK,
+		uintptr(unsafe.Pointer(srcBytes)),
+		uintptr(unsafe.Pointer(dstBytes)),
+		0,
+	)
+	runtime.KeepAlive(srcBytes)
+	runtime.KeepAlive(dstBytes)
+	if errno == 0 {
+		return fmt.Errorf("expected ENOENT, but link succeeded")
+	}
+	return nil
+}
+
+// linkSymlinkEexist creates a regular file, then attempts to create a symlink
+// at the same path via raw SYS_SYMLINK. The syscall fails with EEXIST because
+// the link path already exists, but ior captures the enter_symlink tracepoint.
+func linkSymlinkEexist() error {
+	dir, cleanup, err := makeTempDir("link-symlink-eexist")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	existingPath := filepath.Join(dir, "symlink-eexist.txt")
+	fd, err := syscall.Open(existingPath, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+
+	targetBytes, err := syscall.BytePtrFromString("/tmp/dummy-target")
+	if err != nil {
+		return fmt.Errorf("target bytes: %w", err)
+	}
+	linkBytes, err := syscall.BytePtrFromString(existingPath)
+	if err != nil {
+		return fmt.Errorf("link path bytes: %w", err)
+	}
+
+	_, _, errno := syscall.Syscall(
+		syscall.SYS_SYMLINK,
+		uintptr(unsafe.Pointer(targetBytes)),
+		uintptr(unsafe.Pointer(linkBytes)),
+		0,
+	)
+	runtime.KeepAlive(targetBytes)
+	runtime.KeepAlive(linkBytes)
+	if errno == 0 {
+		return fmt.Errorf("expected EEXIST, but symlink succeeded")
+	}
+	return nil
+}
+
+// linkReadlinkatEinval creates a regular file and calls readlinkat(2) on it.
+// The syscall fails with EINVAL because the path is not a symlink, but ior
+// captures the enter_readlinkat tracepoint on syscall entry.
+func linkReadlinkatEinval() error {
+	dir, cleanup, err := makeTempDir("link-readlinkat-einval")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	regularFile := "readlinkat-einval.txt"
+	regularPath := filepath.Join(dir, regularFile)
+	fd, err := syscall.Open(regularPath, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+
+	dirFD, err := syscall.Open(dir, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	if err != nil {
+		return fmt.Errorf("open dir: %w", err)
+	}
+	defer syscall.Close(dirFD)
+
+	nameBytes, err := syscall.BytePtrFromString(regularFile)
+	if err != nil {
+		return fmt.Errorf("name bytes: %w", err)
+	}
+	buf := make([]byte, 256)
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_READLINKAT,
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(nameBytes)),
+		uintptr(unsafe.Pointer(&buf[0])),
+		uintptr(len(buf)),
+		0, 0,
+	)
+	runtime.KeepAlive(nameBytes)
+	runtime.KeepAlive(buf)
+	if errno == 0 {
+		return fmt.Errorf("expected EINVAL, but readlinkat succeeded")
+	}
+	return nil
+}
+
+// rawLink calls link(2) via raw SYS_LINK.
+func rawLink(oldPath, newPath string) error {
+	oldBytes, err := syscall.BytePtrFromString(oldPath)
+	if err != nil {
+		return fmt.Errorf("old path bytes: %w", err)
+	}
+	newBytes, err := syscall.BytePtrFromString(newPath)
+	if err != nil {
+		return fmt.Errorf("new path bytes: %w", err)
+	}
+	_, _, errno := syscall.Syscall(
+		syscall.SYS_LINK,
+		uintptr(unsafe.Pointer(oldBytes)),
+		uintptr(unsafe.Pointer(newBytes)),
+		0,
+	)
+	runtime.KeepAlive(oldBytes)
+	runtime.KeepAlive(newBytes)
+	if errno != 0 {
+		return fmt.Errorf("link: %w", errno)
+	}
+	return nil
+}
+
+// rawSymlink calls symlink(2) via raw SYS_SYMLINK.
+func rawSymlink(target, linkPath string) error {
+	targetBytes, err := syscall.BytePtrFromString(target)
+	if err != nil {
+		return fmt.Errorf("target path bytes: %w", err)
+	}
+	linkBytes, err := syscall.BytePtrFromString(linkPath)
+	if err != nil {
+		return fmt.Errorf("link path bytes: %w", err)
+	}
+	_, _, errno := syscall.Syscall(
+		syscall.SYS_SYMLINK,
+		uintptr(unsafe.Pointer(targetBytes)),
+		uintptr(unsafe.Pointer(linkBytes)),
+		0,
+	)
+	runtime.KeepAlive(targetBytes)
+	runtime.KeepAlive(linkBytes)
+	if errno != 0 {
+		return fmt.Errorf("symlink: %w", errno)
+	}
+	return nil
+}
+
+// rawReadlink calls readlink(2) via raw SYS_READLINK.
+func rawReadlink(path string) error {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	buf := make([]byte, 256)
+	_, _, errno := syscall.Syscall(
+		syscall.SYS_READLINK,
+		uintptr(unsafe.Pointer(pathBytes)),
+		uintptr(unsafe.Pointer(&buf[0])),
+		uintptr(len(buf)),
+	)
+	runtime.KeepAlive(pathBytes)
+	runtime.KeepAlive(buf)
+	if errno != 0 {
+		return fmt.Errorf("readlink: %w", errno)
+	}
+	return nil
+}
diff --git a/integrationtests/cmd/ioworkload/scenario_open.go b/integrationtests/cmd/ioworkload/scenario_open.go
new file mode 100644
index 0000000..449549c
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_open.go
@@ -0,0 +1,228 @@
+package main
+
+import (
+	"fmt"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"syscall"
+	"unsafe"
+)
+
+// openBasic opens a file with O_RDWR|O_CREAT, then closes it.
+func openBasic() error {
+	dir, cleanup, err := makeTempDir("open-basic")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "testfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	return syscall.Close(fd)
+}
+
+// openCreat creates a file via raw SYS_CREAT.
+// Go's syscall.Creat wraps Open which delegates to openat on amd64,
+// so we use the raw syscall to actually exercise the creat tracepoint.
+func openCreat() error {
+	dir, cleanup, err := makeTempDir("open-creat")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "creatfile.txt")
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	fd, _, errno := syscall.Syscall(syscall.SYS_CREAT, uintptr(unsafe.Pointer(pathBytes)), 0o644, 0)
+	runtime.KeepAlive(pathBytes)
+	if errno != 0 {
+		return fmt.Errorf("creat: %w", errno)
+	}
+	return syscall.Close(int(fd))
+}
+
+// openEnoent attempts to open a nonexistent file path. The openat syscall
+// returns ENOENT, but ior should still capture the enter_openat tracepoint
+// because the filename is read on entry before the syscall executes.
+func openEnoent() error {
+	dir, cleanup, err := makeTempDir("open-enoent")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "nonexistent", "enoentfile.txt")
+	_, err = syscall.Open(path, syscall.O_RDONLY, 0)
+	if err == nil {
+		return fmt.Errorf("expected ENOENT, but open succeeded")
+	}
+	return nil
+}
+
+// openRdonlyWrite opens a file O_RDONLY, then attempts to write to it.
+// The write fails with EBADF, but ior should capture both the openat
+// tracepoint and the write tracepoint.
+func openRdonlyWrite() error {
+	dir, cleanup, err := makeTempDir("open-rdonly-write")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "rdonlyfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("create file: %w", err)
+	}
+	syscall.Close(fd)
+
+	fd, err = syscall.Open(path, syscall.O_RDONLY, 0)
+	if err != nil {
+		return fmt.Errorf("open rdonly: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	_, err = syscall.Write(fd, []byte("should fail"))
+	if err == nil {
+		return fmt.Errorf("expected write to rdonly fd to fail")
+	}
+	return nil
+}
+
+// openPidFilter spawns a child process that performs file I/O. Since ior
+// filters by the workload PID, the child's I/O should NOT appear in results.
+// The parent also performs its own open so the test can verify positive and
+// negative expectations simultaneously.
+func openPidFilter() error {
+	dir, cleanup, err := makeTempDir("open-pid-filter")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	// Parent opens a file (should be captured by ior).
+	parentPath := filepath.Join(dir, "parentfile.txt")
+	fd, err := syscall.Open(parentPath, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("parent open: %w", err)
+	}
+	syscall.Close(fd)
+
+	// Spawn a child process that creates a file with a distinctive name.
+	childPath := filepath.Join(dir, "childfile.txt")
+	cmd := exec.Command("touch", childPath)
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("child touch: %w", err)
+	}
+	return nil
+}
+
+// openByHandleAt creates a file, resolves its handle via name_to_handle_at,
+// then opens it via open_by_handle_at. Requires root (CAP_DAC_READ_SEARCH).
+// LockOSThread prevents goroutine migration between the two syscalls so that
+// ior sees the same TID for both and can correlate the path.
+func openByHandleAt() error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	dir, cleanup, err := makeTempDir("open-by-handle-at")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "handlefile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+
+	handle, mountFD, err := nameToHandleAt(dir, "handlefile.txt")
+	if err != nil {
+		return fmt.Errorf("name_to_handle_at: %w", err)
+	}
+	defer syscall.Close(mountFD)
+
+	fd2, err := openByHandleAtSyscall(mountFD, handle, syscall.O_RDONLY)
+	if err != nil {
+		return fmt.Errorf("open_by_handle_at: %w", err)
+	}
+	return syscall.Close(fd2)
+}
+
+// fileHandle matches the kernel's struct file_handle layout.
+type fileHandle struct {
+	Size uint32
+	Type int32
+	// Handle bytes follow immediately after.
+}
+
+const (
+	sysNameToHandleAt = 303
+	sysOpenByHandleAt = 304
+)
+
+// nameToHandleAt calls name_to_handle_at(2) and returns the file handle
+// and the directory fd. The caller can pass this dirFD as the mount_fd
+// argument to open_by_handle_at since any fd on the same filesystem works.
+func nameToHandleAt(dirPath, name string) ([]byte, int, error) {
+	dirFD, err := syscall.Open(dirPath, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	if err != nil {
+		return nil, 0, fmt.Errorf("open dir: %w", err)
+	}
+
+	nameBytes, err := syscall.BytePtrFromString(name)
+	if err != nil {
+		syscall.Close(dirFD)
+		return nil, 0, fmt.Errorf("name bytes: %w", err)
+	}
+
+	// Start with a buffer large enough for most handles.
+	buf := make([]byte, unsafe.Sizeof(fileHandle{})+128)
+	fh := (*fileHandle)(unsafe.Pointer(&buf[0]))
+	fh.Size = uint32(len(buf) - int(unsafe.Sizeof(fileHandle{})))
+
+	var mountID int32
+	_, _, errno := syscall.Syscall6(
+		sysNameToHandleAt,
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(nameBytes)),
+		uintptr(unsafe.Pointer(fh)),
+		uintptr(unsafe.Pointer(&mountID)),
+		0, 0,
+	)
+	if errno != 0 {
+		syscall.Close(dirFD)
+		return nil, 0, fmt.Errorf("syscall: %w", errno)
+	}
+
+	handleLen := int(unsafe.Sizeof(fileHandle{})) + int(fh.Size)
+	handle := make([]byte, handleLen)
+	copy(handle, buf[:handleLen])
+
+	return handle, dirFD, nil
+}
+
+// openByHandleAtSyscall calls open_by_handle_at(2).
+func openByHandleAtSyscall(mountFD int, handle []byte, flags int) (int, error) {
+	fd, _, errno := syscall.Syscall(
+		sysOpenByHandleAt,
+		uintptr(mountFD),
+		uintptr(unsafe.Pointer(&handle[0])),
+		uintptr(flags),
+	)
+	if errno != 0 {
+		return 0, fmt.Errorf("syscall: %w", errno)
+	}
+	return int(fd), nil
+}
diff --git a/integrationtests/cmd/ioworkload/scenario_readwrite.go b/integrationtests/cmd/ioworkload/scenario_readwrite.go
new file mode 100644
index 0000000..c676b90
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_readwrite.go
@@ -0,0 +1,263 @@
+package main
+
+import (
+	"fmt"
+	"path/filepath"
+	"runtime"
+	"syscall"
+	"unsafe"
+)
+
+// readwriteBasic opens a file, writes data, seeks to start, reads it back.
+func readwriteBasic() error {
+	dir, cleanup, err := makeTempDir("readwrite-basic")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "rwfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	data := []byte("hello from ioworkload")
+	if _, err := syscall.Write(fd, data); err != nil {
+		return fmt.Errorf("write: %w", err)
+	}
+	if _, err := syscall.Seek(fd, 0, 0); err != nil {
+		return fmt.Errorf("seek: %w", err)
+	}
+
+	buf := make([]byte, len(data))
+	if _, err := syscall.Read(fd, buf); err != nil {
+		return fmt.Errorf("read: %w", err)
+	}
+	return nil
+}
+
+// readwritePread opens a file, writes data, then reads it back via pread64.
+func readwritePread() error {
+	dir, cleanup, err := makeTempDir("readwrite-pread")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "preadfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	data := []byte("pread test data")
+	if _, err := syscall.Write(fd, data); err != nil {
+		return fmt.Errorf("write: %w", err)
+	}
+
+	buf := make([]byte, len(data))
+	if _, err := syscall.Pread(fd, buf, 0); err != nil {
+		return fmt.Errorf("pread: %w", err)
+	}
+	return nil
+}
+
+// readwritePwrite opens a file and writes data via pwrite64.
+func readwritePwrite() error {
+	dir, cleanup, err := makeTempDir("readwrite-pwrite")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "pwritefile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	if _, err := syscall.Pwrite(fd, []byte("pwrite test data"), 0); err != nil {
+		return fmt.Errorf("pwrite: %w", err)
+	}
+	return nil
+}
+
+// readwriteReadv opens a file, writes data, then reads it back via readv.
+func readwriteReadv() error {
+	dir, cleanup, err := makeTempDir("readwrite-readv")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "readvfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	data := []byte("readv test data here")
+	if _, err := syscall.Write(fd, data); err != nil {
+		return fmt.Errorf("write: %w", err)
+	}
+	if _, err := syscall.Seek(fd, 0, 0); err != nil {
+		return fmt.Errorf("seek: %w", err)
+	}
+
+	buf1 := make([]byte, 5)
+	buf2 := make([]byte, 15)
+	iovs := []syscall.Iovec{
+		{Base: &buf1[0], Len: uint64(len(buf1))},
+		{Base: &buf2[0], Len: uint64(len(buf2))},
+	}
+	_, _, errno := syscall.Syscall(syscall.SYS_READV, uintptr(fd), uintptr(unsafe.Pointer(&iovs[0])), uintptr(len(iovs)))
+	runtime.KeepAlive(buf1)
+	runtime.KeepAlive(buf2)
+	if errno != 0 {
+		return fmt.Errorf("readv: %w", errno)
+	}
+	return nil
+}
+
+// readwriteWritev opens a file and writes data via writev.
+func readwriteWritev() error {
+	dir, cleanup, err := makeTempDir("readwrite-writev")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "writevfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	buf1 := []byte("writev ")
+	buf2 := []byte("test data")
+	iovs := []syscall.Iovec{
+		{Base: &buf1[0], Len: uint64(len(buf1))},
+		{Base: &buf2[0], Len: uint64(len(buf2))},
+	}
+	_, _, errno := syscall.Syscall(syscall.SYS_WRITEV, uintptr(fd), uintptr(unsafe.Pointer(&iovs[0])), uintptr(len(iovs)))
+	runtime.KeepAlive(buf1)
+	runtime.KeepAlive(buf2)
+	if errno != 0 {
+		return fmt.Errorf("writev: %w", errno)
+	}
+	return nil
+}
+
+// readwriteWronlyRead opens a file O_WRONLY, then attempts to read from it.
+// The read fails with EBADF, but ior should capture the enter_read tracepoint
+// because arguments are read on syscall entry before the kernel returns an error.
+func readwriteWronlyRead() error {
+	dir, cleanup, err := makeTempDir("readwrite-wronly-read")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "wronlyfile.txt")
+	fd, err := syscall.Open(path, syscall.O_WRONLY|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	buf := make([]byte, 16)
+	_, err = syscall.Read(fd, buf)
+	if err == nil {
+		return fmt.Errorf("expected read from wronly fd to fail")
+	}
+	return nil
+}
+
+// readwriteRdonlyWrite opens a file O_RDONLY, then attempts to write to it.
+// The write fails with EBADF, but ior should capture the enter_write tracepoint
+// because arguments are read on syscall entry before the kernel returns an error.
+func readwriteRdonlyWrite() error {
+	dir, cleanup, err := makeTempDir("readwrite-rdonly-write")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "rdonlywritefile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("create file: %w", err)
+	}
+	syscall.Close(fd)
+
+	fd, err = syscall.Open(path, syscall.O_RDONLY, 0)
+	if err != nil {
+		return fmt.Errorf("open rdonly: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	_, err = syscall.Write(fd, []byte("should fail"))
+	if err == nil {
+		return fmt.Errorf("expected write to rdonly fd to fail")
+	}
+	return nil
+}
+
+// readwritePreadInvalid calls pread64 with a negative offset (-1).
+// The syscall fails with EINVAL, but ior should capture the enter_pread64
+// tracepoint because arguments are read on syscall entry.
+func readwritePreadInvalid() error {
+	dir, cleanup, err := makeTempDir("readwrite-pread-invalid")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "preadinvalid.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	if _, err := syscall.Write(fd, []byte("some data")); err != nil {
+		return fmt.Errorf("write: %w", err)
+	}
+
+	buf := make([]byte, 16)
+	_, err = syscall.Pread(fd, buf, -1)
+	if err == nil {
+		return fmt.Errorf("expected pread with negative offset to fail")
+	}
+	return nil
+}
+
+// readwritePwriteInvalid calls pwrite64 with a negative offset (-1).
+// The syscall fails with EINVAL, but ior should capture the enter_pwrite64
+// tracepoint because arguments are read on syscall entry.
+func readwritePwriteInvalid() error {
+	dir, cleanup, err := makeTempDir("readwrite-pwrite-invalid")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "pwriteinvalid.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	_, err = syscall.Pwrite(fd, []byte("should fail"), -1)
+	if err == nil {
+		return fmt.Errorf("expected pwrite with negative offset to fail")
+	}
+	return nil
+}
diff --git a/integrationtests/cmd/ioworkload/scenario_rename.go b/integrationtests/cmd/ioworkload/scenario_rename.go
new file mode 100644
index 0000000..95b93e1
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_rename.go
@@ -0,0 +1,251 @@
+package main
+
+import (
+	"fmt"
+	"path/filepath"
+	"runtime"
+	"syscall"
+	"unsafe"
+)
+
+const (
+	sysRenameat2       = 316 // SYS_RENAMEAT2 on amd64
+	renameNoreplaceFlag = 1  // RENAME_NOREPLACE
+)
+
+// renameBasic creates a file and renames it via rename(2).
+// Uses raw SYS_RENAME because Go's syscall.Rename wraps renameat on amd64.
+func renameBasic() error {
+	dir, cleanup, err := makeTempDir("rename-basic")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	oldPath := filepath.Join(dir, "oldname.txt")
+	newPath := filepath.Join(dir, "newname.txt")
+
+	fd, err := syscall.Open(oldPath, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+
+	oldBytes, err := syscall.BytePtrFromString(oldPath)
+	if err != nil {
+		return fmt.Errorf("old path bytes: %w", err)
+	}
+	newBytes, err := syscall.BytePtrFromString(newPath)
+	if err != nil {
+		return fmt.Errorf("new path bytes: %w", err)
+	}
+
+	_, _, errno := syscall.Syscall(
+		syscall.SYS_RENAME,
+		uintptr(unsafe.Pointer(oldBytes)),
+		uintptr(unsafe.Pointer(newBytes)),
+		0,
+	)
+	runtime.KeepAlive(oldBytes)
+	runtime.KeepAlive(newBytes)
+	if errno != 0 {
+		return fmt.Errorf("rename: %w", errno)
+	}
+	return nil
+}
+
+// renameRenameat creates a file and renames it via renameat(2).
+func renameRenameat() error {
+	dir, cleanup, err := makeTempDir("rename-renameat")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	oldName := "renameat-old.txt"
+	newName := "renameat-new.txt"
+	path := filepath.Join(dir, oldName)
+
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+
+	dirFD, err := syscall.Open(dir, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	if err != nil {
+		return fmt.Errorf("open dir: %w", err)
+	}
+	defer syscall.Close(dirFD)
+
+	oldBytes, err := syscall.BytePtrFromString(oldName)
+	if err != nil {
+		return fmt.Errorf("old name bytes: %w", err)
+	}
+	newBytes, err := syscall.BytePtrFromString(newName)
+	if err != nil {
+		return fmt.Errorf("new name bytes: %w", err)
+	}
+
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS_RENAMEAT,
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(oldBytes)),
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(newBytes)),
+		0, 0,
+	)
+	runtime.KeepAlive(oldBytes)
+	runtime.KeepAlive(newBytes)
+	if errno != 0 {
+		return fmt.Errorf("renameat: %w", errno)
+	}
+	return nil
+}
+
+// renameRenameat2 creates a file and renames it via renameat2(2) with no flags.
+func renameRenameat2() error {
+	dir, cleanup, err := makeTempDir("rename-renameat2")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	oldName := "renameat2-old.txt"
+	newName := "renameat2-new.txt"
+	path := filepath.Join(dir, oldName)
+
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if err := syscall.Close(fd); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+
+	dirFD, err := syscall.Open(dir, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	if err != nil {
+		return fmt.Errorf("open dir: %w", err)
+	}
+	defer syscall.Close(dirFD)
+
+	oldBytes, err := syscall.BytePtrFromString(oldName)
+	if err != nil {
+		return fmt.Errorf("old name bytes: %w", err)
+	}
+	newBytes, err := syscall.BytePtrFromString(newName)
+	if err != nil {
+		return fmt.Errorf("new name bytes: %w", err)
+	}
+
+	_, _, errno := syscall.Syscall6(
+		sysRenameat2,
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(oldBytes)),
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(newBytes)),
+		0, // flags=0: plain rename
+		0,
+	)
+	runtime.KeepAlive(oldBytes)
+	runtime.KeepAlive(newBytes)
+	if errno != 0 {
+		return fmt.Errorf("renameat2: %w", errno)
+	}
+	return nil
+}
+
+// renameEnoent attempts to rename a nonexistent file via raw SYS_RENAME.
+// The syscall fails with ENOENT, but ior captures the tracepoint on entry.
+func renameEnoent() error {
+	dir, cleanup, err := makeTempDir("rename-enoent")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	oldPath := filepath.Join(dir, "rename-enoent-missing.txt")
+	newPath := filepath.Join(dir, "rename-enoent-new.txt")
+
+	oldBytes, err := syscall.BytePtrFromString(oldPath)
+	if err != nil {
+		return fmt.Errorf("old path bytes: %w", err)
+	}
+	newBytes, err := syscall.BytePtrFromString(newPath)
+	if err != nil {
+		return fmt.Errorf("new path bytes: %w", err)
+	}
+
+	_, _, errno := syscall.Syscall(
+		syscall.SYS_RENAME,
+		uintptr(unsafe.Pointer(oldBytes)),
+		uintptr(unsafe.Pointer(newBytes)),
+		0,
+	)
+	runtime.KeepAlive(oldBytes)
+	runtime.KeepAlive(newBytes)
+	if errno == 0 {
+		return fmt.Errorf("expected ENOENT, but rename succeeded")
+	}
+	return nil
+}
+
+// renameNoreplace creates two files, then attempts renameat2 with
+// RENAME_NOREPLACE. Because the target already exists, the syscall fails
+// with EEXIST, but ior captures the tracepoint on entry.
+func renameNoreplace() error {
+	dir, cleanup, err := makeTempDir("rename-noreplace")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	srcName := "noreplace-src.txt"
+	dstName := "noreplace-dst.txt"
+
+	for _, name := range []string{srcName, dstName} {
+		path := filepath.Join(dir, name)
+		fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+		if err != nil {
+			return fmt.Errorf("create %s: %w", name, err)
+		}
+		if err := syscall.Close(fd); err != nil {
+			return fmt.Errorf("close %s: %w", name, err)
+		}
+	}
+
+	dirFD, err := syscall.Open(dir, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	if err != nil {
+		return fmt.Errorf("open dir: %w", err)
+	}
+	defer syscall.Close(dirFD)
+
+	srcBytes, err := syscall.BytePtrFromString(srcName)
+	if err != nil {
+		return fmt.Errorf("src name bytes: %w", err)
+	}
+	dstBytes, err := syscall.BytePtrFromString(dstName)
+	if err != nil {
+		return fmt.Errorf("dst name bytes: %w", err)
+	}
+
+	_, _, errno := syscall.Syscall6(
+		sysRenameat2,
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(srcBytes)),
+		uintptr(dirFD),
+		uintptr(unsafe.Pointer(dstBytes)),
+		renameNoreplaceFlag,
+		0,
+	)
+	runtime.KeepAlive(srcBytes)
+	runtime.KeepAlive(dstBytes)
+	if errno == 0 {
+		return fmt.Errorf("expected EEXIST, but renameat2 NOREPLACE succeeded")
+	}
+	return nil
+}
diff --git a/integrationtests/cmd/ioworkload/scenario_stat.go b/integrationtests/cmd/ioworkload/scenario_stat.go
new file mode 100644
index 0000000..ce9807d
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_stat.go
@@ -0,0 +1,274 @@
+package main
+
+import (
+	"fmt"
+	"path/filepath"
+	"runtime"
+	"syscall"
+	"unsafe"
+)
+
+const (
+	sysStatx       = 332
+	rOK            = 0x4    // R_OK
+	statxBasicMask = 0x07ff // STATX_BASIC_STATS
+	atFDCwd        = -100   // AT_FDCWD
+)
+
+// statBasic creates a file and stats it via raw SYS_STAT (newstat).
+// We use the raw syscall because Go's syscall.Stat wraps newfstatat on amd64.
+func statBasic() error {
+	dir, cleanup, err := makeTempDir("stat-basic")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "statfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	syscall.Close(fd)
+
+	var stat syscall.Stat_t
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	_, _, errno := syscall.Syscall(syscall.SYS_STAT, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(&stat)), 0)
+	runtime.KeepAlive(pathBytes)
+	runtime.KeepAlive(&stat)
+	if errno != 0 {
+		return fmt.Errorf("stat: %w", errno)
+	}
+	return nil
+}
+
+// statFstat creates a file and stats it via raw SYS_FSTAT (newfstat).
+// This is an fd_event, so ior resolves the path via its fd lookup table.
+func statFstat() error {
+	dir, cleanup, err := makeTempDir("stat-fstat")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "fstatfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	var stat syscall.Stat_t
+	_, _, errno := syscall.Syscall(syscall.SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(&stat)), 0)
+	runtime.KeepAlive(&stat)
+	if errno != 0 {
+		return fmt.Errorf("fstat: %w", errno)
+	}
+	return nil
+}
+
+// statLstat creates a file and stats it via raw SYS_LSTAT (newlstat).
+// We use the raw syscall because Go's syscall.Lstat wraps newfstatat on amd64.
+func statLstat() error {
+	dir, cleanup, err := makeTempDir("stat-lstat")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "lstatfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	syscall.Close(fd)
+
+	var stat syscall.Stat_t
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	_, _, errno := syscall.Syscall(syscall.SYS_LSTAT, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(&stat)), 0)
+	runtime.KeepAlive(pathBytes)
+	runtime.KeepAlive(&stat)
+	if errno != 0 {
+		return fmt.Errorf("lstat: %w", errno)
+	}
+	return nil
+}
+
+// statNewfstatat creates a file and stats it via Go's syscall.Stat, which
+// wraps SYS_NEWFSTATAT (fstatat with AT_FDCWD) on amd64.
+func statNewfstatat() error {
+	dir, cleanup, err := makeTempDir("stat-newfstatat")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "fstatatfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	syscall.Close(fd)
+
+	var stat syscall.Stat_t
+	if err := syscall.Stat(path, &stat); err != nil {
+		return fmt.Errorf("newfstatat: %w", err)
+	}
+	return nil
+}
+
+// statStatx creates a file and stats it via raw statx(2) syscall.
+func statStatx() error {
+	dir, cleanup, err := makeTempDir("stat-statx")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "statxfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	syscall.Close(fd)
+
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	var buf [256]byte // statx struct is ~256 bytes
+	_, _, errno := syscall.Syscall6(
+		sysStatx,
+		^uintptr(99), // AT_FDCWD (-100)
+		uintptr(unsafe.Pointer(pathBytes)),
+		0,
+		statxBasicMask,
+		uintptr(unsafe.Pointer(&buf[0])),
+		0,
+	)
+	runtime.KeepAlive(pathBytes)
+	runtime.KeepAlive(buf)
+	if errno != 0 {
+		return fmt.Errorf("statx: %w", errno)
+	}
+	return nil
+}
+
+// statAccess creates a file and checks access via raw SYS_ACCESS.
+// We use the raw syscall because Go's syscall.Access wraps faccessat on amd64.
+func statAccess() error {
+	dir, cleanup, err := makeTempDir("stat-access")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "accessfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	syscall.Close(fd)
+
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	_, _, errno := syscall.Syscall(syscall.SYS_ACCESS, uintptr(unsafe.Pointer(pathBytes)), rOK, 0)
+	runtime.KeepAlive(pathBytes)
+	if errno != 0 {
+		return fmt.Errorf("access: %w", errno)
+	}
+	return nil
+}
+
+// statFaccessat creates a file and checks access via faccessat(2).
+// Go's syscall.Faccessat wraps SYS_FACCESSAT.
+func statFaccessat() error {
+	dir, cleanup, err := makeTempDir("stat-faccessat")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "faccessatfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	syscall.Close(fd)
+
+	if err := syscall.Faccessat(atFDCwd, path, uint32(rOK), 0); err != nil {
+		return fmt.Errorf("faccessat: %w", err)
+	}
+	return nil
+}
+
+// statEnoent attempts to stat a nonexistent file via raw SYS_STAT.
+// The syscall fails with ENOENT, but ior captures the enter_newstat
+// tracepoint because the filename is read on entry.
+func statEnoent() error {
+	dir, cleanup, err := makeTempDir("stat-enoent")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "stat-enoent-missing.txt")
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	var stat syscall.Stat_t
+	_, _, errno := syscall.Syscall(syscall.SYS_STAT, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(&stat)), 0)
+	runtime.KeepAlive(pathBytes)
+	runtime.KeepAlive(&stat)
+	if errno == 0 {
+		return fmt.Errorf("expected ENOENT, but stat succeeded")
+	}
+	return nil
+}
+
+// statAccessEnoent attempts to check access on a nonexistent file via raw
+// SYS_ACCESS. The syscall fails with ENOENT, but ior captures the
+// enter_access tracepoint because the path is read on entry.
+// We use ENOENT instead of EACCES because integration tests run as root,
+// which bypasses DAC permission checks.
+func statAccessEnoent() error {
+	dir, cleanup, err := makeTempDir("stat-access-enoent")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "access-enoent-missing.txt")
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return fmt.Errorf("path bytes: %w", err)
+	}
+	_, _, errno := syscall.Syscall(syscall.SYS_ACCESS, uintptr(unsafe.Pointer(pathBytes)), rOK, 0)
+	runtime.KeepAlive(pathBytes)
+	if errno == 0 {
+		return fmt.Errorf("expected ENOENT, but access succeeded")
+	}
+	return nil
+}
+
+// statFstatEbadf calls raw SYS_FSTAT on an invalid fd (99999).
+// The syscall fails with EBADF, but ior captures the enter_newfstat
+// tracepoint because it is recorded on syscall entry.
+func statFstatEbadf() error {
+	var stat syscall.Stat_t
+	_, _, errno := syscall.Syscall(syscall.SYS_FSTAT, 99999, uintptr(unsafe.Pointer(&stat)), 0)
+	runtime.KeepAlive(&stat)
+	if errno == 0 {
+		return fmt.Errorf("expected EBADF, but fstat succeeded")
+	}
+	return nil
+}
diff --git a/integrationtests/cmd/ioworkload/scenario_sync.go b/integrationtests/cmd/ioworkload/scenario_sync.go
new file mode 100644
index 0000000..214c783
--- /dev/null
+++ b/integrationtests/cmd/ioworkload/scenario_sync.go
@@ -0,0 +1,108 @@
+package main
+
+import (
+	"fmt"
+	"path/filepath"
+	"syscall"
+)
+
+// syncBasic opens a file, writes data, and fsyncs it.
+func syncBasic() error {
+	dir, cleanup, err := makeTempDir("sync-basic")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "syncfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	if _, err := syscall.Write(fd, []byte("sync me")); err != nil {
+		return fmt.Errorf("write: %w", err)
+	}
+	return syscall.Fsync(fd)
+}
+
+// syncFdatasync opens a file, writes data, and fdatasyncs it.
+func syncFdatasync() error {
+	dir, cleanup, err := makeTempDir("sync-fdatasync")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "fdatasyncfile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	if _, err := syscall.Write(fd, []byte("fdatasync me")); err != nil {
+		return fmt.Errorf("write: %w", err)
+	}
+	return syscall.Fdatasync(fd)
+}
+
+// syncSync calls sync(2) to flush all filesystem caches.
+// sync is a null_event with no file arguments.
+func syncSync() error {
+	syscall.Sync()
+	return nil
+}
+
+// syncSyncFileRange opens a file, writes data, then calls sync_file_range(2).
+func syncSyncFileRange() error {
+	dir, cleanup, err := makeTempDir("sync-sync-file-range")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	path := filepath.Join(dir, "syncrangefile.txt")
+	fd, err := syscall.Open(path, syscall.O_RDWR|syscall.O_CREAT, 0o644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer sysc