A reworked BPF API

That "fixup" mechanism seems vaguely reminiscent of something that "binder" does.
binder doesn't use fds, but it has similar numeric handles not unlike the "watch descriptors" that inotify uses.

A "binder_buffer" (which holds a message) contains some data and then some "offsets".
The "offsets" are references into the data part of the buffer where "flat_binder_object"s are stored, which contain a type, some flags and an object identifier.
Based on the the type, some transformation is performed on the object identifier to convert between "remote" and "local" references. (see switch (fp->type) in binder_transaction()).

This is much the same as converting between kernel-internal pointers and user-space fd numbers.