Pretty interesting idea — few things I was curious about:

What was the benchmark actually run against? Like what kind of disk size, workload, and baseline are those numbers comparing to?

Also, how does this behave on something like a busy db server where reads/writes are constantly happening? And more generally, what kind of overhead does the agent add to the running system — both with the eBPF path and in cases where it falls back to the non-eBPF flow?