I am trying to fully understand the ruledata struct. I've got most of it figured out but I can't find a reason for the final 32 bits (last index) of mask to not be flipped on when selecting all syscalls. In general it appears that the final 32 bits are never used.