This is just for calls within ntdll as CEF patches syscall entrypoints before starting the thread, the JIT is expected to install its own call checker that redirects functions itself afaict (I needed one for fex to work under Windows). Will give what you suggested a go though if it's preferred over the generic solution