3	When not in append mode and when running on a kernel that
	   supports the sysctls, ktrace will output a header containing a
	   magic number and the emulation/syscall table in the ktrace.out
	   dump.

I'm not sure this is right.  When appending or using `-i' to trace
children, more than one process may be represented in the ktrace file.
It seems to me that you need a special record for the syscall list,
tagged with a pid and recorded internally to kdump(1) by pid, and
allow for the syscall list to be replaced (i.e. after execve(2)).