last remaining change is that we'll need to stitch together enter/exit events from dtrace, as before kill(SIGSTOP) would only trigger on the way back out to userland (i.e. after a blocking syscall had finished) but now since we suspend the thread(s) independent of dtrace events, we see events before they have actually finished.
(from https://github.com/kallsyms/mrr/issues/3#issuecomment-1475457212)