I am a bit confused while looking at the HandleOpenOrCreateSyscallRecord function, i do see a mention of the a2 field but it’s not very clear to me if it’s really using the masks..