This is a great post, nice work! Once it was identified the root cause was due to it leveraging an ancient stat -- would it have been easier/safer to patch the syscall table to point stat at stat64? Presumably that can be done without rolling your own kernel module?