Local detection bypass via mutable syscall arguments

Detection bypass in Falco 0.28.1 and earlier allows local users to conceal monitored activity by changing in-flight syscall arguments. The engine consumes mutable userspace syscall arguments, while userfaultfd lets the invoking process pause execution and replace those values before Falco evaluates them. Code execution as a local user on a monitored Linux host or container is required; exploitation suppresses rules that should flag the original arguments.