actually, i realised that the struct emul hook solution doesn't really work. you don't want to base it on the emul of the ktraced process but of the ktrace(1) process it self.... that's the whole point here -- to make 32 bit ktrace(2) syscall output 32 bit ktrace records. .mrg.