pkg/bpf: improve modify return syscall detection err flow

pkg/bpf: improve modify return syscall detection err flow #6655