Tracing the Linux kernel with Retsnoop

It would be nice to have an example of a regular syscall failing with -EINVAL and how to determine the exact place that error is "raised", rather than just examples of bpf() failures.