So impressive, although it's source code patches can likely disable needed functionality, and in the process allow a 0day to turn into a denial of service attack.
> testing system call block policies for any unique calls or call parameters found
Obviously it can only work with data it has so if your system has some rarely-exercised code paths it might break those, but at least it won't break the 99% use-cases?