core/entry: Report syscall correctly for trace and audit