Arbitrage issues wherever glibc and the syscall differ seem to be where the bugs and security issues lay or at least a good place to look. Whenever a person ha

Arbitrage issues wherever glibc and the syscall differ seem to be where the bugs and security issues lay or at least a good place to look. Whenever a person has to roll out their own handler it will almost always undergo less testing and auditing. The article points gettid which for at least 10 years required your own method to use, and the comment section for the article points out that the getpid call had caching that was bugged for a long time. Having no glibc implementation of a syscall affects its usage and the total number of people knowledgeable about that function, so it would be a perfect place to look for bugs and security. In the nearly reverse case a poor implementation of a glibc handler might be doing something that would allow an attacker to take advantage. The same applies where the glibc and syscall functionality differ, an aspect only part of the syscall might be undertested.