Wait so they… they have a hook in the mmap() equivalent that allows AV software to scan new pages mapped as executable? I see the reasoning but damn does that feel cursed.