mloclall () requires the application under check to call them such that the application process cannot modify memory pages.

Whereas ebpf allows instrumentation free enforcement. Plus, app devs do not need to be aware of this fact. This facilitate separate of responsibility in code and organization.