When the kernel informs us that we lost events "CPU:%d [LOST %lu EVENTS]\n", we cannot assume that a filename we saved from a do_sys_open line corresponds to the rval we get from the following sys_open line. With the existing logic, we do, and under certain conditions it's possible to get a spurious "valid" open of a nonexistent file in the opensnoop output.
When the kernel informs us that we lost events "CPU:%d [LOST %lu EVENTS]\n", we cannot assume that a filename we saved from a do_sys_open line corresponds to the rval we get from the following sys_open line. With the existing logic, we do, and under certain conditions it's possible to get a spurious "valid" open of a nonexistent file in the opensnoop output.
(I'll have a PR for this shortly.)