I guess it's about internal ntdll syscalls (that use `hybrid_patchable`) and calls from jit? `hybrid_patchable` passes additionally `hp_target` symbol in `x9`, early `__os_arm64x_dispatch_call` could just jump to it. Early `__os_arm64x_dispatch_icall` could probably just assume that the target is ARM64EC. For calls from the jit module, I imagine that auxiliary IAT support could be useful. We could then somehow special-case jit to never revert it, even if patching is detected.