x-post from the #CADGD9ACF channel: I made an initial (draft) PR that integrates the BPF code I have been working on: https://github.com/osquery/osquery/pull/6254