There is a high chance that it will crash your system.

- Unlocked access to ->comm

- What if buf is less than 6 bytes or not NULL terminated?

- Only searching for sys_close() is not enough, it will also find any function pointer to sys_close() and then return a false syscall table.

Anyway, a nice hack. :-)