> If the tracee enters PTRACE_EVENT_EXEC stop without TIF_SYSCALL_TRACE > and then the tracer does ptrace(PTRACE_SYSCALL), we should report > SYSCALL_EXIT event.
Indeed. But note that without PTRACE_O_TRACEEXEC, we do not have an "event stop", but just send ourselves a normal signal. In that case, a PTRACE_SYSCALL resuming from the entry stop for execve will hit the exit stop first (just like any other syscall), and then dequeue the signal. Thanks, Roland