Based on #2796 and #2793, it looks like the eBPF devices code needs some more tests to make sure it's acting properly. If we can do emulation of the BPF program (like I did for seccomp), that would be ideal.