syscall call-from verification

The following change only permits system calls from address-ranges in the process which system calls are expected from.

If you manage to upload exploit code containing a raw system call sequence and instruction, and mprotect -w+x that block, such a system call will not succeed but the process is killed. This obliges the attacker to use the libc system call stubs, which in some circumstances are difficult to find due to libc random-relinking at boot...

https://marc.info/?l=openbsd-tech&m=157488907117170

#syscall