ebpf syscall close does not give the right fd

close-fd-problem.c

//https://stackoverflow.com/questions/70344928/bpf-kprobe-macro-provides-unexpected-value-of-function-argument

// Trying without BPF_KPROBE
SEC("kprobe/__x64_sys_close")
int myclose(struct pt_regs *ctx) {
    u32 pid = bpf_get_current_pid_tgid() >> 32; 
    int fd = PT_REGS_PARM1_CORE(ctx);

    // filter specific pid for simplicity
    if (pid != SRV_PID) {
    ¦   return 0;
    }   

    // debug fd arg (expected to be equal to fd returned on accept4)
    bpf_printk("closed pid=%d fd=%d", pid, fd);
    return 0;
}

// with BPF_KPROBE
SEC("kprobe/__x64_sys_close")
int BPF_KPROBE(close, int fd) {
    u64 id = bpf_get_current_pid_tgid();
    u32 pid = id >> 32;
    // filter specific pid for simplicity
    if (pid != SRV_PID) {
    ¦   return 0;
    }

    // debug fd arg (expected to be equal to fd returned on accept4)
    bpf_printk("closed pid=%d fd=%d", pid, fd);
    return 0;
}