Thanks for spotting out, that's also what I wild-guessed. The new libcap code supports indirect syscalls, it seems mainly for Go support (or whatever others). My further wild guess is that the weak link trickery doesn't work as expected.