I haven't watched that talk, but in the past I've done this by LD_PRELOADing a shared object that injected a seccomp filter on init with SECCOMP_RET_TRAP as app

I haven't watched that talk, but in the past I've done this by LD_PRELOADing a shared object that injected a seccomp filter on init with SECCOMP_RET_TRAP as appropriate and then rewrote the saved thread state higher up the stack to simulate the syscall / replace the return value. It worked pretty well.