73% of What We Blocked in a Month Was One Syscall Your Sandbox Cannot See