diff --git a/Makefile b/Makefile
index f1469b3424526eb0de82fdd444a623b3ff8074ae..ab055e95a99ecaac6798c1047107654021b886b8 100644
--- a/Makefile
+++ b/Makefile
@@ -30,7 +30,7 @@ ifneq ($(CLEAN_BUILD),)
 endif
 
 LOCAL_GENERATOR_IMAGE ?= ebpf-generator:latest
-CILIUM_EBPF_VERSION := v0.17.3
+CILIUM_EBPF_VERSION := v0.18.0
 GOLANGCI_LINT_VERSION = v1.61.0
 GO_VERSION = "1.23.4"
 PROTOC_VERSION = "3.19.4"
diff --git a/go.mod b/go.mod
index b334bd07699b9ca103dccd3a16795ed92688f347..526713514f99e71f0ea700ad04d73da5cb59c06b 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ toolchain go1.23.5
 
 require (
 	github.com/caarlos0/env/v11 v11.3.1
-	github.com/cilium/ebpf v0.17.3
+	github.com/cilium/ebpf v0.18.0
 	github.com/fsnotify/fsnotify v1.8.0
 	github.com/gavv/monotime v0.0.0-20190418164738-30dba4353424
 	github.com/gopacket/gopacket v1.3.1
diff --git a/go.sum b/go.sum
index 4188f49365d55c227c7904be57de31860281cc7a..fb092baabb2f811aaf51c62f21c55d68bef21ce9 100644
--- a/go.sum
+++ b/go.sum
@@ -143,8 +143,8 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/cilium/ebpf v0.17.3 h1:FnP4r16PWYSE4ux6zN+//jMcW4nMVRvuTLVTvCjyyjg=
-github.com/cilium/ebpf v0.17.3/go.mod h1:G5EDHij8yiLzaqn0WjyfJHvRa+3aDlReIaLVRMvOyJk=
+github.com/cilium/ebpf v0.18.0 h1:OsSwqS4y+gQHxaKgg2U/+Fev834kdnsQbtzRnbVC6Gs=
+github.com/cilium/ebpf v0.18.0/go.mod h1:vmsAT73y4lW2b4peE+qcOqw6MxvWQdC+LiU5gd/xyo4=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/clbanning/x2j v0.0.0-20191024224557-825249438eec/go.mod h1:jMjuTZXRI4dUb/I5gc9Hdhagfvm9+RyrPryS/auMzxE=
@@ -315,8 +315,8 @@ github.com/go-openapi/validate v0.18.0/go.mod h1:Uh4HdOzKt19xGIGm1qHf/ofbX1YQ4Y+
 github.com/go-openapi/validate v0.19.2/go.mod h1:1tRCw7m3jtI8eNWEEliiAqUIcBztB2KDnRCRMUi7GTA=
 github.com/go-openapi/validate v0.19.3/go.mod h1:90Vh6jjkTn+OT1Eefm0ZixWNFjhtOH7vS9k0lo6zwJo=
 github.com/go-openapi/validate v0.19.8/go.mod h1:8DJv2CVJQ6kGNpFW6eV9N3JviE1C85nY1c2z52x1Gk4=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
+github.com/go-quicktest/qt v1.101.1-0.20240301121107-c6c8733fa1e6 h1:teYtXy9B7y5lHTp8V9KPxpYRAVA7dozigQcMiBust1s=
+github.com/go-quicktest/qt v1.101.1-0.20240301121107-c6c8733fa1e6/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
diff --git a/vendor/github.com/cilium/ebpf/.gitattributes b/vendor/github.com/cilium/ebpf/.gitattributes
index 113f97b9804d2241226d5d410fa5ea1630c0e712..ea7c9a89c3244b5dfb11b2be67eb826a56cc9a7c 100644
--- a/vendor/github.com/cilium/ebpf/.gitattributes
+++ b/vendor/github.com/cilium/ebpf/.gitattributes
@@ -1 +1,4 @@
+# Force line ending normalisation
+*	text=auto
+# Show types.go in the PR diff view by default
 internal/sys/types.go linguist-generated=false
diff --git a/vendor/github.com/cilium/ebpf/.golangci.yaml b/vendor/github.com/cilium/ebpf/.golangci.yaml
index 8298e59ed809418ddbd5427dbc425b56dfb23e02..cb17a6ec669f35698062400bffc2212a19d157e9 100644
--- a/vendor/github.com/cilium/ebpf/.golangci.yaml
+++ b/vendor/github.com/cilium/ebpf/.golangci.yaml
@@ -1,31 +1,38 @@
----
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
-    - goimports
-    - gosimple
+    - depguard
     - govet
     - ineffassign
     - misspell
     - staticcheck
-    - typecheck
     - unused
+  settings:
+    staticcheck:
+      checks:
+        [
+          # Defaults
+          "all", "-ST1000", "-ST1003", "-ST1016", "-ST1020", "-ST1021", "-ST1022",
+          # Convert slice of bytes to string when printing it.
+          "-QF1010",
+        ]
+    depguard:
+      rules:
+        no-x-sys-unix:
+          files:
+            - '!**/internal/unix/*.go'
+            - '!**/examples/**/*.go'
+            - '!**/docs/**/*.go'
+          deny:
+            - pkg: golang.org/x/sys/unix
+              desc: use internal/unix instead
+
+formatters:
+  enable:
     - gofmt
-    - depguard
-linters-settings:
-  goimports:
-    # A comma-separated list of prefixes, which, if set, checks import paths
-    # with the given prefixes are grouped after 3rd-party packages.
-    # Default: ""
-    local-prefixes: github.com/cilium/ebpf
-  depguard:
-    rules:
-      no-x-sys-unix:
-        files:
-          # Filenames are matched against absolute paths, include **/ at the start.
-          - '!**/internal/unix/*.go'
-          - '!**/examples/**/*.go'
-          - '!**/docs/**/*.go'
-        deny:
-          - pkg: golang.org/x/sys/unix
-            desc: use internal/unix instead
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/cilium/ebpf
diff --git a/vendor/github.com/cilium/ebpf/CODEOWNERS b/vendor/github.com/cilium/ebpf/CODEOWNERS
index 0f76dce85c8ee371900b0155acd2eae8439ecaa9..bd0a61158e601bc3607027c39d3fbc975cf5d95c 100644
--- a/vendor/github.com/cilium/ebpf/CODEOWNERS
+++ b/vendor/github.com/cilium/ebpf/CODEOWNERS
@@ -8,6 +8,4 @@ ringbuf/ @florianl
 
 btf/ @dylandreimerink
 
-cmd/bpf2go/ @mejedi
-
 docs/ @ti-mo
diff --git a/vendor/github.com/cilium/ebpf/Makefile b/vendor/github.com/cilium/ebpf/Makefile
index e0fe974920602c3f61938e427265366725528157..18e9bb08fb22610776d02fd67318fb4147d6b783 100644
--- a/vendor/github.com/cilium/ebpf/Makefile
+++ b/vendor/github.com/cilium/ebpf/Makefile
@@ -16,7 +16,10 @@ UIDGID := $(shell stat -c '%u:%g' ${REPODIR})
 # Prefer podman if installed, otherwise use docker.
 # Note: Setting the var at runtime will always override.
 CONTAINER_ENGINE ?= $(if $(shell command -v podman), podman, docker)
-CONTAINER_RUN_ARGS ?= $(if $(filter ${CONTAINER_ENGINE}, podman), --log-driver=none, --user "${UIDGID}")
+CONTAINER_RUN_ARGS ?= $(if $(filter ${CONTAINER_ENGINE}, podman), \
+		--log-driver=none \
+		-v "$(shell go env GOCACHE)":/root/.cache/go-build \
+		-v "$(shell go env GOMODCACHE)":/go/pkg/mod, --user "${UIDGID}")
 
 IMAGE := $(shell cat ${REPODIR}/testdata/docker/IMAGE)
 VERSION := $(shell cat ${REPODIR}/testdata/docker/VERSION)
@@ -70,7 +73,7 @@ container-all:
 # (debug) Drop the user into a shell inside the container as root.
 # Set BPF2GO_ envs to make 'make generate' just work.
 container-shell:
-	${CONTAINER_ENGINE} run --rm -ti \
+	${CONTAINER_ENGINE} run --rm -ti ${CONTAINER_RUN_ARGS} \
 		-v "${REPODIR}":/ebpf -w /ebpf \
 		--env BPF2GO_CC="$(CLANG)" \
 		--env BPF2GO_FLAGS="-fdebug-prefix-map=/ebpf=. $(CFLAGS)" \
diff --git a/vendor/github.com/cilium/ebpf/asm/func.go b/vendor/github.com/cilium/ebpf/asm/func.go
index 7a59acf383014b0bf214850919442a14a8c6c610..5ee4e954f5818c51cba68cf89c2124715bcd9060 100644
--- a/vendor/github.com/cilium/ebpf/asm/func.go
+++ b/vendor/github.com/cilium/ebpf/asm/func.go
@@ -1,239 +1,18 @@
 package asm
 
+import "github.com/cilium/ebpf/internal/platform"
+
 //go:generate go run golang.org/x/tools/cmd/stringer@latest -output func_string.go -type=BuiltinFunc
 
 // BuiltinFunc is a built-in eBPF function.
-type BuiltinFunc int32
+type BuiltinFunc uint32
 
-// eBPF built-in functions
-//
-// You can regenerate this list using the following gawk script:
+// BuiltinFuncForPlatform returns a platform specific function constant.
 //
-//	/FN\(.+\),/ {
-//	  match($1, /\(([a-z_0-9]+),/, r)
-//	  split(r[1], p, "_")
-//	  printf "Fn"
-//	  for (i in p) {
-//	    printf "%s%s", toupper(substr(p[i], 1, 1)), substr(p[i], 2)
-//	  }
-//	  print ""
-//	}
-//
-// The script expects include/uapi/linux/bpf.h as it's input.
-const (
-	FnUnspec BuiltinFunc = iota
-	FnMapLookupElem
-	FnMapUpdateElem
-	FnMapDeleteElem
-	FnProbeRead
-	FnKtimeGetNs
-	FnTracePrintk
-	FnGetPrandomU32
-	FnGetSmpProcessorId
-	FnSkbStoreBytes
-	FnL3CsumReplace
-	FnL4CsumReplace
-	FnTailCall
-	FnCloneRedirect
-	FnGetCurrentPidTgid
-	FnGetCurrentUidGid
-	FnGetCurrentComm
-	FnGetCgroupClassid
-	FnSkbVlanPush
-	FnSkbVlanPop
-	FnSkbGetTunnelKey
-	FnSkbSetTunnelKey
-	FnPerfEventRead
-	FnRedirect
-	FnGetRouteRealm
-	FnPerfEventOutput
-	FnSkbLoadBytes
-	FnGetStackid
-	FnCsumDiff
-	FnSkbGetTunnelOpt
-	FnSkbSetTunnelOpt
-	FnSkbChangeProto
-	FnSkbChangeType
-	FnSkbUnderCgroup
-	FnGetHashRecalc
-	FnGetCurrentTask
-	FnProbeWriteUser
-	FnCurrentTaskUnderCgroup
-	FnSkbChangeTail
-	FnSkbPullData
-	FnCsumUpdate
-	FnSetHashInvalid
-	FnGetNumaNodeId
-	FnSkbChangeHead
-	FnXdpAdjustHead
-	FnProbeReadStr
-	FnGetSocketCookie
-	FnGetSocketUid
-	FnSetHash
-	FnSetsockopt
-	FnSkbAdjustRoom
-	FnRedirectMap
-	FnSkRedirectMap
-	FnSockMapUpdate
-	FnXdpAdjustMeta
-	FnPerfEventReadValue
-	FnPerfProgReadValue
-	FnGetsockopt
-	FnOverrideReturn
-	FnSockOpsCbFlagsSet
-	FnMsgRedirectMap
-	FnMsgApplyBytes
-	FnMsgCorkBytes
-	FnMsgPullData
-	FnBind
-	FnXdpAdjustTail
-	FnSkbGetXfrmState
-	FnGetStack
-	FnSkbLoadBytesRelative
-	FnFibLookup
-	FnSockHashUpdate
-	FnMsgRedirectHash
-	FnSkRedirectHash
-	FnLwtPushEncap
-	FnLwtSeg6StoreBytes
-	FnLwtSeg6AdjustSrh
-	FnLwtSeg6Action
-	FnRcRepeat
-	FnRcKeydown
-	FnSkbCgroupId
-	FnGetCurrentCgroupId
-	FnGetLocalStorage
-	FnSkSelectReuseport
-	FnSkbAncestorCgroupId
-	FnSkLookupTcp
-	FnSkLookupUdp
-	FnSkRelease
-	FnMapPushElem
-	FnMapPopElem
-	FnMapPeekElem
-	FnMsgPushData
-	FnMsgPopData
-	FnRcPointerRel
-	FnSpinLock
-	FnSpinUnlock
-	FnSkFullsock
-	FnTcpSock
-	FnSkbEcnSetCe
-	FnGetListenerSock
-	FnSkcLookupTcp
-	FnTcpCheckSyncookie
-	FnSysctlGetName
-	FnSysctlGetCurrentValue
-	FnSysctlGetNewValue
-	FnSysctlSetNewValue
-	FnStrtol
-	FnStrtoul
-	FnSkStorageGet
-	FnSkStorageDelete
-	FnSendSignal
-	FnTcpGenSyncookie
-	FnSkbOutput
-	FnProbeReadUser
-	FnProbeReadKernel
-	FnProbeReadUserStr
-	FnProbeReadKernelStr
-	FnTcpSendAck
-	FnSendSignalThread
-	FnJiffies64
-	FnReadBranchRecords
-	FnGetNsCurrentPidTgid
-	FnXdpOutput
-	FnGetNetnsCookie
-	FnGetCurrentAncestorCgroupId
-	FnSkAssign
-	FnKtimeGetBootNs
-	FnSeqPrintf
-	FnSeqWrite
-	FnSkCgroupId
-	FnSkAncestorCgroupId
-	FnRingbufOutput
-	FnRingbufReserve
-	FnRingbufSubmit
-	FnRingbufDiscard
-	FnRingbufQuery
-	FnCsumLevel
-	FnSkcToTcp6Sock
-	FnSkcToTcpSock
-	FnSkcToTcpTimewaitSock
-	FnSkcToTcpRequestSock
-	FnSkcToUdp6Sock
-	FnGetTaskStack
-	FnLoadHdrOpt
-	FnStoreHdrOpt
-	FnReserveHdrOpt
-	FnInodeStorageGet
-	FnInodeStorageDelete
-	FnDPath
-	FnCopyFromUser
-	FnSnprintfBtf
-	FnSeqPrintfBtf
-	FnSkbCgroupClassid
-	FnRedirectNeigh
-	FnPerCpuPtr
-	FnThisCpuPtr
-	FnRedirectPeer
-	FnTaskStorageGet
-	FnTaskStorageDelete
-	FnGetCurrentTaskBtf
-	FnBprmOptsSet
-	FnKtimeGetCoarseNs
-	FnImaInodeHash
-	FnSockFromFile
-	FnCheckMtu
-	FnForEachMapElem
-	FnSnprintf
-	FnSysBpf
-	FnBtfFindByNameKind
-	FnSysClose
-	FnTimerInit
-	FnTimerSetCallback
-	FnTimerStart
-	FnTimerCancel
-	FnGetFuncIp
-	FnGetAttachCookie
-	FnTaskPtRegs
-	FnGetBranchSnapshot
-	FnTraceVprintk
-	FnSkcToUnixSock
-	FnKallsymsLookupName
-	FnFindVma
-	FnLoop
-	FnStrncmp
-	FnGetFuncArg
-	FnGetFuncRet
-	FnGetFuncArgCnt
-	FnGetRetval
-	FnSetRetval
-	FnXdpGetBuffLen
-	FnXdpLoadBytes
-	FnXdpStoreBytes
-	FnCopyFromUserTask
-	FnSkbSetTstamp
-	FnImaFileHash
-	FnKptrXchg
-	FnMapLookupPercpuElem
-	FnSkcToMptcpSock
-	FnDynptrFromMem
-	FnRingbufReserveDynptr
-	FnRingbufSubmitDynptr
-	FnRingbufDiscardDynptr
-	FnDynptrRead
-	FnDynptrWrite
-	FnDynptrData
-	FnTcpRawGenSyncookieIpv4
-	FnTcpRawGenSyncookieIpv6
-	FnTcpRawCheckSyncookieIpv4
-	FnTcpRawCheckSyncookieIpv6
-	FnKtimeGetTaiNs
-	FnUserRingbufDrain
-	FnCgrpStorageGet
-	FnCgrpStorageDelete
-)
+// Use this if the library doesn't provide a constant yet.
+func BuiltinFuncForPlatform(plat string, value uint32) (BuiltinFunc, error) {
+	return platform.EncodeConstant[BuiltinFunc](plat, value)
+}
 
 // Call emits a function call.
 func (fn BuiltinFunc) Call() Instruction {
diff --git a/vendor/github.com/cilium/ebpf/asm/func_lin.go b/vendor/github.com/cilium/ebpf/asm/func_lin.go
new file mode 100644
index 0000000000000000000000000000000000000000..55c5e762d2ed311f2181302c45449731074c1f72
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/asm/func_lin.go
@@ -0,0 +1,223 @@
+// Code generated by internal/cmd/genfunctions.awk; DO NOT EDIT.
+
+package asm
+
+// Code in this file is derived from Linux, available under the GPL-2.0 WITH Linux-syscall-note.
+
+import "github.com/cilium/ebpf/internal/platform"
+
+// Built-in functions (Linux).
+const (
+	FnUnspec                     = BuiltinFunc(platform.LinuxTag | 0)
+	FnMapLookupElem              = BuiltinFunc(platform.LinuxTag | 1)
+	FnMapUpdateElem              = BuiltinFunc(platform.LinuxTag | 2)
+	FnMapDeleteElem              = BuiltinFunc(platform.LinuxTag | 3)
+	FnProbeRead                  = BuiltinFunc(platform.LinuxTag | 4)
+	FnKtimeGetNs                 = BuiltinFunc(platform.LinuxTag | 5)
+	FnTracePrintk                = BuiltinFunc(platform.LinuxTag | 6)
+	FnGetPrandomU32              = BuiltinFunc(platform.LinuxTag | 7)
+	FnGetSmpProcessorId          = BuiltinFunc(platform.LinuxTag | 8)
+	FnSkbStoreBytes              = BuiltinFunc(platform.LinuxTag | 9)
+	FnL3CsumReplace              = BuiltinFunc(platform.LinuxTag | 10)
+	FnL4CsumReplace              = BuiltinFunc(platform.LinuxTag | 11)
+	FnTailCall                   = BuiltinFunc(platform.LinuxTag | 12)
+	FnCloneRedirect              = BuiltinFunc(platform.LinuxTag | 13)
+	FnGetCurrentPidTgid          = BuiltinFunc(platform.LinuxTag | 14)
+	FnGetCurrentUidGid           = BuiltinFunc(platform.LinuxTag | 15)
+	FnGetCurrentComm             = BuiltinFunc(platform.LinuxTag | 16)
+	FnGetCgroupClassid           = BuiltinFunc(platform.LinuxTag | 17)
+	FnSkbVlanPush                = BuiltinFunc(platform.LinuxTag | 18)
+	FnSkbVlanPop                 = BuiltinFunc(platform.LinuxTag | 19)
+	FnSkbGetTunnelKey            = BuiltinFunc(platform.LinuxTag | 20)
+	FnSkbSetTunnelKey            = BuiltinFunc(platform.LinuxTag | 21)
+	FnPerfEventRead              = BuiltinFunc(platform.LinuxTag | 22)
+	FnRedirect                   = BuiltinFunc(platform.LinuxTag | 23)
+	FnGetRouteRealm              = BuiltinFunc(platform.LinuxTag | 24)
+	FnPerfEventOutput            = BuiltinFunc(platform.LinuxTag | 25)
+	FnSkbLoadBytes               = BuiltinFunc(platform.LinuxTag | 26)
+	FnGetStackid                 = BuiltinFunc(platform.LinuxTag | 27)
+	FnCsumDiff                   = BuiltinFunc(platform.LinuxTag | 28)
+	FnSkbGetTunnelOpt            = BuiltinFunc(platform.LinuxTag | 29)
+	FnSkbSetTunnelOpt            = BuiltinFunc(platform.LinuxTag | 30)
+	FnSkbChangeProto             = BuiltinFunc(platform.LinuxTag | 31)
+	FnSkbChangeType              = BuiltinFunc(platform.LinuxTag | 32)
+	FnSkbUnderCgroup             = BuiltinFunc(platform.LinuxTag | 33)
+	FnGetHashRecalc              = BuiltinFunc(platform.LinuxTag | 34)
+	FnGetCurrentTask             = BuiltinFunc(platform.LinuxTag | 35)
+	FnProbeWriteUser             = BuiltinFunc(platform.LinuxTag | 36)
+	FnCurrentTaskUnderCgroup     = BuiltinFunc(platform.LinuxTag | 37)
+	FnSkbChangeTail              = BuiltinFunc(platform.LinuxTag | 38)
+	FnSkbPullData                = BuiltinFunc(platform.LinuxTag | 39)
+	FnCsumUpdate                 = BuiltinFunc(platform.LinuxTag | 40)
+	FnSetHashInvalid             = BuiltinFunc(platform.LinuxTag | 41)
+	FnGetNumaNodeId              = BuiltinFunc(platform.LinuxTag | 42)
+	FnSkbChangeHead              = BuiltinFunc(platform.LinuxTag | 43)
+	FnXdpAdjustHead              = BuiltinFunc(platform.LinuxTag | 44)
+	FnProbeReadStr               = BuiltinFunc(platform.LinuxTag | 45)
+	FnGetSocketCookie            = BuiltinFunc(platform.LinuxTag | 46)
+	FnGetSocketUid               = BuiltinFunc(platform.LinuxTag | 47)
+	FnSetHash                    = BuiltinFunc(platform.LinuxTag | 48)
+	FnSetsockopt                 = BuiltinFunc(platform.LinuxTag | 49)
+	FnSkbAdjustRoom              = BuiltinFunc(platform.LinuxTag | 50)
+	FnRedirectMap                = BuiltinFunc(platform.LinuxTag | 51)
+	FnSkRedirectMap              = BuiltinFunc(platform.LinuxTag | 52)
+	FnSockMapUpdate              = BuiltinFunc(platform.LinuxTag | 53)
+	FnXdpAdjustMeta              = BuiltinFunc(platform.LinuxTag | 54)
+	FnPerfEventReadValue         = BuiltinFunc(platform.LinuxTag | 55)
+	FnPerfProgReadValue          = BuiltinFunc(platform.LinuxTag | 56)
+	FnGetsockopt                 = BuiltinFunc(platform.LinuxTag | 57)
+	FnOverrideReturn             = BuiltinFunc(platform.LinuxTag | 58)
+	FnSockOpsCbFlagsSet          = BuiltinFunc(platform.LinuxTag | 59)
+	FnMsgRedirectMap             = BuiltinFunc(platform.LinuxTag | 60)
+	FnMsgApplyBytes              = BuiltinFunc(platform.LinuxTag | 61)
+	FnMsgCorkBytes               = BuiltinFunc(platform.LinuxTag | 62)
+	FnMsgPullData                = BuiltinFunc(platform.LinuxTag | 63)
+	FnBind                       = BuiltinFunc(platform.LinuxTag | 64)
+	FnXdpAdjustTail              = BuiltinFunc(platform.LinuxTag | 65)
+	FnSkbGetXfrmState            = BuiltinFunc(platform.LinuxTag | 66)
+	FnGetStack                   = BuiltinFunc(platform.LinuxTag | 67)
+	FnSkbLoadBytesRelative       = BuiltinFunc(platform.LinuxTag | 68)
+	FnFibLookup                  = BuiltinFunc(platform.LinuxTag | 69)
+	FnSockHashUpdate             = BuiltinFunc(platform.LinuxTag | 70)
+	FnMsgRedirectHash            = BuiltinFunc(platform.LinuxTag | 71)
+	FnSkRedirectHash             = BuiltinFunc(platform.LinuxTag | 72)
+	FnLwtPushEncap               = BuiltinFunc(platform.LinuxTag | 73)
+	FnLwtSeg6StoreBytes          = BuiltinFunc(platform.LinuxTag | 74)
+	FnLwtSeg6AdjustSrh           = BuiltinFunc(platform.LinuxTag | 75)
+	FnLwtSeg6Action              = BuiltinFunc(platform.LinuxTag | 76)
+	FnRcRepeat                   = BuiltinFunc(platform.LinuxTag | 77)
+	FnRcKeydown                  = BuiltinFunc(platform.LinuxTag | 78)
+	FnSkbCgroupId                = BuiltinFunc(platform.LinuxTag | 79)
+	FnGetCurrentCgroupId         = BuiltinFunc(platform.LinuxTag | 80)
+	FnGetLocalStorage            = BuiltinFunc(platform.LinuxTag | 81)
+	FnSkSelectReuseport          = BuiltinFunc(platform.LinuxTag | 82)
+	FnSkbAncestorCgroupId        = BuiltinFunc(platform.LinuxTag | 83)
+	FnSkLookupTcp                = BuiltinFunc(platform.LinuxTag | 84)
+	FnSkLookupUdp                = BuiltinFunc(platform.LinuxTag | 85)
+	FnSkRelease                  = BuiltinFunc(platform.LinuxTag | 86)
+	FnMapPushElem                = BuiltinFunc(platform.LinuxTag | 87)
+	FnMapPopElem                 = BuiltinFunc(platform.LinuxTag | 88)
+	FnMapPeekElem                = BuiltinFunc(platform.LinuxTag | 89)
+	FnMsgPushData                = BuiltinFunc(platform.LinuxTag | 90)
+	FnMsgPopData                 = BuiltinFunc(platform.LinuxTag | 91)
+	FnRcPointerRel               = BuiltinFunc(platform.LinuxTag | 92)
+	FnSpinLock                   = BuiltinFunc(platform.LinuxTag | 93)
+	FnSpinUnlock                 = BuiltinFunc(platform.LinuxTag | 94)
+	FnSkFullsock                 = BuiltinFunc(platform.LinuxTag | 95)
+	FnTcpSock                    = BuiltinFunc(platform.LinuxTag | 96)
+	FnSkbEcnSetCe                = BuiltinFunc(platform.LinuxTag | 97)
+	FnGetListenerSock            = BuiltinFunc(platform.LinuxTag | 98)
+	FnSkcLookupTcp               = BuiltinFunc(platform.LinuxTag | 99)
+	FnTcpCheckSyncookie          = BuiltinFunc(platform.LinuxTag | 100)
+	FnSysctlGetName              = BuiltinFunc(platform.LinuxTag | 101)
+	FnSysctlGetCurrentValue      = BuiltinFunc(platform.LinuxTag | 102)
+	FnSysctlGetNewValue          = BuiltinFunc(platform.LinuxTag | 103)
+	FnSysctlSetNewValue          = BuiltinFunc(platform.LinuxTag | 104)
+	FnStrtol                     = BuiltinFunc(platform.LinuxTag | 105)
+	FnStrtoul                    = BuiltinFunc(platform.LinuxTag | 106)
+	FnSkStorageGet               = BuiltinFunc(platform.LinuxTag | 107)
+	FnSkStorageDelete            = BuiltinFunc(platform.LinuxTag | 108)
+	FnSendSignal                 = BuiltinFunc(platform.LinuxTag | 109)
+	FnTcpGenSyncookie            = BuiltinFunc(platform.LinuxTag | 110)
+	FnSkbOutput                  = BuiltinFunc(platform.LinuxTag | 111)
+	FnProbeReadUser              = BuiltinFunc(platform.LinuxTag | 112)
+	FnProbeReadKernel            = BuiltinFunc(platform.LinuxTag | 113)
+	FnProbeReadUserStr           = BuiltinFunc(platform.LinuxTag | 114)
+	FnProbeReadKernelStr         = BuiltinFunc(platform.LinuxTag | 115)
+	FnTcpSendAck                 = BuiltinFunc(platform.LinuxTag | 116)
+	FnSendSignalThread           = BuiltinFunc(platform.LinuxTag | 117)
+	FnJiffies64                  = BuiltinFunc(platform.LinuxTag | 118)
+	FnReadBranchRecords          = BuiltinFunc(platform.LinuxTag | 119)
+	FnGetNsCurrentPidTgid        = BuiltinFunc(platform.LinuxTag | 120)
+	FnXdpOutput                  = BuiltinFunc(platform.LinuxTag | 121)
+	FnGetNetnsCookie             = BuiltinFunc(platform.LinuxTag | 122)
+	FnGetCurrentAncestorCgroupId = BuiltinFunc(platform.LinuxTag | 123)
+	FnSkAssign                   = BuiltinFunc(platform.LinuxTag | 124)
+	FnKtimeGetBootNs             = BuiltinFunc(platform.LinuxTag | 125)
+	FnSeqPrintf                  = BuiltinFunc(platform.LinuxTag | 126)
+	FnSeqWrite                   = BuiltinFunc(platform.LinuxTag | 127)
+	FnSkCgroupId                 = BuiltinFunc(platform.LinuxTag | 128)
+	FnSkAncestorCgroupId         = BuiltinFunc(platform.LinuxTag | 129)
+	FnRingbufOutput              = BuiltinFunc(platform.LinuxTag | 130)
+	FnRingbufReserve             = BuiltinFunc(platform.LinuxTag | 131)
+	FnRingbufSubmit              = BuiltinFunc(platform.LinuxTag | 132)
+	FnRingbufDiscard             = BuiltinFunc(platform.LinuxTag | 133)
+	FnRingbufQuery               = BuiltinFunc(platform.LinuxTag | 134)
+	FnCsumLevel                  = BuiltinFunc(platform.LinuxTag | 135)
+	FnSkcToTcp6Sock              = BuiltinFunc(platform.LinuxTag | 136)
+	FnSkcToTcpSock               = BuiltinFunc(platform.LinuxTag | 137)
+	FnSkcToTcpTimewaitSock       = BuiltinFunc(platform.LinuxTag | 138)
+	FnSkcToTcpRequestSock        = BuiltinFunc(platform.LinuxTag | 139)
+	FnSkcToUdp6Sock              = BuiltinFunc(platform.LinuxTag | 140)
+	FnGetTaskStack               = BuiltinFunc(platform.LinuxTag | 141)
+	FnLoadHdrOpt                 = BuiltinFunc(platform.LinuxTag | 142)
+	FnStoreHdrOpt                = BuiltinFunc(platform.LinuxTag | 143)
+	FnReserveHdrOpt              = BuiltinFunc(platform.LinuxTag | 144)
+	FnInodeStorageGet            = BuiltinFunc(platform.LinuxTag | 145)
+	FnInodeStorageDelete         = BuiltinFunc(platform.LinuxTag | 146)
+	FnDPath                      = BuiltinFunc(platform.LinuxTag | 147)
+	FnCopyFromUser               = BuiltinFunc(platform.LinuxTag | 148)
+	FnSnprintfBtf                = BuiltinFunc(platform.LinuxTag | 149)
+	FnSeqPrintfBtf               = BuiltinFunc(platform.LinuxTag | 150)
+	FnSkbCgroupClassid           = BuiltinFunc(platform.LinuxTag | 151)
+	FnRedirectNeigh              = BuiltinFunc(platform.LinuxTag | 152)
+	FnPerCpuPtr                  = BuiltinFunc(platform.LinuxTag | 153)
+	FnThisCpuPtr                 = BuiltinFunc(platform.LinuxTag | 154)
+	FnRedirectPeer               = BuiltinFunc(platform.LinuxTag | 155)
+	FnTaskStorageGet             = BuiltinFunc(platform.LinuxTag | 156)
+	FnTaskStorageDelete          = BuiltinFunc(platform.LinuxTag | 157)
+	FnGetCurrentTaskBtf          = BuiltinFunc(platform.LinuxTag | 158)
+	FnBprmOptsSet                = BuiltinFunc(platform.LinuxTag | 159)
+	FnKtimeGetCoarseNs           = BuiltinFunc(platform.LinuxTag | 160)
+	FnImaInodeHash               = BuiltinFunc(platform.LinuxTag | 161)
+	FnSockFromFile               = BuiltinFunc(platform.LinuxTag | 162)
+	FnCheckMtu                   = BuiltinFunc(platform.LinuxTag | 163)
+	FnForEachMapElem             = BuiltinFunc(platform.LinuxTag | 164)
+	FnSnprintf                   = BuiltinFunc(platform.LinuxTag | 165)
+	FnSysBpf                     = BuiltinFunc(platform.LinuxTag | 166)
+	FnBtfFindByNameKind          = BuiltinFunc(platform.LinuxTag | 167)
+	FnSysClose                   = BuiltinFunc(platform.LinuxTag | 168)
+	FnTimerInit                  = BuiltinFunc(platform.LinuxTag | 169)
+	FnTimerSetCallback           = BuiltinFunc(platform.LinuxTag | 170)
+	FnTimerStart                 = BuiltinFunc(platform.LinuxTag | 171)
+	FnTimerCancel                = BuiltinFunc(platform.LinuxTag | 172)
+	FnGetFuncIp                  = BuiltinFunc(platform.LinuxTag | 173)
+	FnGetAttachCookie            = BuiltinFunc(platform.LinuxTag | 174)
+	FnTaskPtRegs                 = BuiltinFunc(platform.LinuxTag | 175)
+	FnGetBranchSnapshot          = BuiltinFunc(platform.LinuxTag | 176)
+	FnTraceVprintk               = BuiltinFunc(platform.LinuxTag | 177)
+	FnSkcToUnixSock              = BuiltinFunc(platform.LinuxTag | 178)
+	FnKallsymsLookupName         = BuiltinFunc(platform.LinuxTag | 179)
+	FnFindVma                    = BuiltinFunc(platform.LinuxTag | 180)
+	FnLoop                       = BuiltinFunc(platform.LinuxTag | 181)
+	FnStrncmp                    = BuiltinFunc(platform.LinuxTag | 182)
+	FnGetFuncArg                 = BuiltinFunc(platform.LinuxTag | 183)
+	FnGetFuncRet                 = BuiltinFunc(platform.LinuxTag | 184)
+	FnGetFuncArgCnt              = BuiltinFunc(platform.LinuxTag | 185)
+	FnGetRetval                  = BuiltinFunc(platform.LinuxTag | 186)
+	FnSetRetval                  = BuiltinFunc(platform.LinuxTag | 187)
+	FnXdpGetBuffLen              = BuiltinFunc(platform.LinuxTag | 188)
+	FnXdpLoadBytes               = BuiltinFunc(platform.LinuxTag | 189)
+	FnXdpStoreBytes              = BuiltinFunc(platform.LinuxTag | 190)
+	FnCopyFromUserTask           = BuiltinFunc(platform.LinuxTag | 191)
+	FnSkbSetTstamp               = BuiltinFunc(platform.LinuxTag | 192)
+	FnImaFileHash                = BuiltinFunc(platform.LinuxTag | 193)
+	FnKptrXchg                   = BuiltinFunc(platform.LinuxTag | 194)
+	FnMapLookupPercpuElem        = BuiltinFunc(platform.LinuxTag | 195)
+	FnSkcToMptcpSock             = BuiltinFunc(platform.LinuxTag | 196)
+	FnDynptrFromMem              = BuiltinFunc(platform.LinuxTag | 197)
+	FnRingbufReserveDynptr       = BuiltinFunc(platform.LinuxTag | 198)
+	FnRingbufSubmitDynptr        = BuiltinFunc(platform.LinuxTag | 199)
+	FnRingbufDiscardDynptr       = BuiltinFunc(platform.LinuxTag | 200)
+	FnDynptrRead                 = BuiltinFunc(platform.LinuxTag | 201)
+	FnDynptrWrite                = BuiltinFunc(platform.LinuxTag | 202)
+	FnDynptrData                 = BuiltinFunc(platform.LinuxTag | 203)
+	FnTcpRawGenSyncookieIpv4     = BuiltinFunc(platform.LinuxTag | 204)
+	FnTcpRawGenSyncookieIpv6     = BuiltinFunc(platform.LinuxTag | 205)
+	FnTcpRawCheckSyncookieIpv4   = BuiltinFunc(platform.LinuxTag | 206)
+	FnTcpRawCheckSyncookieIpv6   = BuiltinFunc(platform.LinuxTag | 207)
+	FnKtimeGetTaiNs              = BuiltinFunc(platform.LinuxTag | 208)
+	FnUserRingbufDrain           = BuiltinFunc(platform.LinuxTag | 209)
+	FnCgrpStorageGet             = BuiltinFunc(platform.LinuxTag | 210)
+	FnCgrpStorageDelete          = BuiltinFunc(platform.LinuxTag | 211)
+)
diff --git a/vendor/github.com/cilium/ebpf/asm/func_string.go b/vendor/github.com/cilium/ebpf/asm/func_string.go
index 6c4ba3789263eae3fc4bfdbd02e2426415aecebe..d5d624f094836fa3efaba03ee742f726ef36f265 100644
--- a/vendor/github.com/cilium/ebpf/asm/func_string.go
+++ b/vendor/github.com/cilium/ebpf/asm/func_string.go
@@ -220,15 +220,57 @@ func _() {
 	_ = x[FnUserRingbufDrain-209]
 	_ = x[FnCgrpStorageGet-210]
 	_ = x[FnCgrpStorageDelete-211]
+	_ = x[WindowsFnMapLookupElem-268435457]
+	_ = x[WindowsFnMapUpdateElem-268435458]
+	_ = x[WindowsFnMapDeleteElem-268435459]
+	_ = x[WindowsFnMapLookupAndDeleteElem-268435460]
+	_ = x[WindowsFnTailCall-268435461]
+	_ = x[WindowsFnGetPrandomU32-268435462]
+	_ = x[WindowsFnKtimeGetBootNs-268435463]
+	_ = x[WindowsFnGetSmpProcessorId-268435464]
+	_ = x[WindowsFnKtimeGetNs-268435465]
+	_ = x[WindowsFnCsumDiff-268435466]
+	_ = x[WindowsFnRingbufOutput-268435467]
+	_ = x[WindowsFnTracePrintk2-268435468]
+	_ = x[WindowsFnTracePrintk3-268435469]
+	_ = x[WindowsFnTracePrintk4-268435470]
+	_ = x[WindowsFnTracePrintk5-268435471]
+	_ = x[WindowsFnMapPushElem-268435472]
+	_ = x[WindowsFnMapPopElem-268435473]
+	_ = x[WindowsFnMapPeekElem-268435474]
+	_ = x[WindowsFnGetCurrentPidTgid-268435475]
+	_ = x[WindowsFnGetCurrentLogonId-268435476]
+	_ = x[WindowsFnIsCurrentAdmin-268435477]
+	_ = x[WindowsFnMemcpy-268435478]
+	_ = x[WindowsFnMemcmp-268435479]
+	_ = x[WindowsFnMemset-268435480]
+	_ = x[WindowsFnMemmove-268435481]
+	_ = x[WindowsFnGetSocketCookie-268435482]
+	_ = x[WindowsFnStrncpyS-268435483]
+	_ = x[WindowsFnStrncatS-268435484]
+	_ = x[WindowsFnStrnlenS-268435485]
+	_ = x[WindowsFnKtimeGetBootMs-268435486]
+	_ = x[WindowsFnKtimeGetMs-268435487]
 }
 
-const _BuiltinFunc_name = "FnUnspecFnMapLookupElemFnMapUpdateElemFnMapDeleteElemFnProbeReadFnKtimeGetNsFnTracePrintkFnGetPrandomU32FnGetSmpProcessorIdFnSkbStoreBytesFnL3CsumReplaceFnL4CsumReplaceFnTailCallFnCloneRedirectFnGetCurrentPidTgidFnGetCurrentUidGidFnGetCurrentCommFnGetCgroupClassidFnSkbVlanPushFnSkbVlanPopFnSkbGetTunnelKeyFnSkbSetTunnelKeyFnPerfEventReadFnRedirectFnGetRouteRealmFnPerfEventOutputFnSkbLoadBytesFnGetStackidFnCsumDiffFnSkbGetTunnelOptFnSkbSetTunnelOptFnSkbChangeProtoFnSkbChangeTypeFnSkbUnderCgroupFnGetHashRecalcFnGetCurrentTaskFnProbeWriteUserFnCurrentTaskUnderCgroupFnSkbChangeTailFnSkbPullDataFnCsumUpdateFnSetHashInvalidFnGetNumaNodeIdFnSkbChangeHeadFnXdpAdjustHeadFnProbeReadStrFnGetSocketCookieFnGetSocketUidFnSetHashFnSetsockoptFnSkbAdjustRoomFnRedirectMapFnSkRedirectMapFnSockMapUpdateFnXdpAdjustMetaFnPerfEventReadValueFnPerfProgReadValueFnGetsockoptFnOverrideReturnFnSockOpsCbFlagsSetFnMsgRedirectMapFnMsgApplyBytesFnMsgCorkBytesFnMsgPullDataFnBindFnXdpAdjustTailFnSkbGetXfrmStateFnGetStackFnSkbLoadBytesRelativeFnFibLookupFnSockHashUpdateFnMsgRedirectHashFnSkRedirectHashFnLwtPushEncapFnLwtSeg6StoreBytesFnLwtSeg6AdjustSrhFnLwtSeg6ActionFnRcRepeatFnRcKeydownFnSkbCgroupIdFnGetCurrentCgroupIdFnGetLocalStorageFnSkSelectReuseportFnSkbAncestorCgroupIdFnSkLookupTcpFnSkLookupUdpFnSkReleaseFnMapPushElemFnMapPopElemFnMapPeekElemFnMsgPushDataFnMsgPopDataFnRcPointerRelFnSpinLockFnSpinUnlockFnSkFullsockFnTcpSockFnSkbEcnSetCeFnGetListenerSockFnSkcLookupTcpFnTcpCheckSyncookieFnSysctlGetNameFnSysctlGetCurrentValueFnSysctlGetNewValueFnSysctlSetNewValueFnStrtolFnStrtoulFnSkStorageGetFnSkStorageDeleteFnSendSignalFnTcpGenSyncookieFnSkbOutputFnProbeReadUserFnProbeReadKernelFnProbeReadUserStrFnProbeReadKernelStrFnTcpSendAckFnSendSignalThreadFnJiffies64FnReadBranchRecordsFnGetNsCurrentPidTgidFnXdpOutputFnGetNetnsCookieFnGetCurrentAncestorCgroupIdFnSkAssignFnKtimeGetBootNsFnSeqPrintfFnSeqWriteFnSkCgroupIdFnSkAncestorCgroupIdFnRingbufOutputFnRingbufReserveFnRingbufSubmitFnRingbufDiscardFnRingbufQueryFnCsumLevelFnSkcToTcp6SockFnSkcToTcpSockFnSkcToTcpTimewaitSockFnSkcToTcpRequestSockFnSkcToUdp6SockFnGetTaskStackFnLoadHdrOptFnStoreHdrOptFnReserveHdrOptFnInodeStorageGetFnInodeStorageDeleteFnDPathFnCopyFromUserFnSnprintfBtfFnSeqPrintfBtfFnSkbCgroupClassidFnRedirectNeighFnPerCpuPtrFnThisCpuPtrFnRedirectPeerFnTaskStorageGetFnTaskStorageDeleteFnGetCurrentTaskBtfFnBprmOptsSetFnKtimeGetCoarseNsFnImaInodeHashFnSockFromFileFnCheckMtuFnForEachMapElemFnSnprintfFnSysBpfFnBtfFindByNameKindFnSysCloseFnTimerInitFnTimerSetCallbackFnTimerStartFnTimerCancelFnGetFuncIpFnGetAttachCookieFnTaskPtRegsFnGetBranchSnapshotFnTraceVprintkFnSkcToUnixSockFnKallsymsLookupNameFnFindVmaFnLoopFnStrncmpFnGetFuncArgFnGetFuncRetFnGetFuncArgCntFnGetRetvalFnSetRetvalFnXdpGetBuffLenFnXdpLoadBytesFnXdpStoreBytesFnCopyFromUserTaskFnSkbSetTstampFnImaFileHashFnKptrXchgFnMapLookupPercpuElemFnSkcToMptcpSockFnDynptrFromMemFnRingbufReserveDynptrFnRingbufSubmitDynptrFnRingbufDiscardDynptrFnDynptrReadFnDynptrWriteFnDynptrDataFnTcpRawGenSyncookieIpv4FnTcpRawGenSyncookieIpv6FnTcpRawCheckSyncookieIpv4FnTcpRawCheckSyncookieIpv6FnKtimeGetTaiNsFnUserRingbufDrainFnCgrpStorageGetFnCgrpStorageDelete"
+const (
+	_BuiltinFunc_name_0 = "FnUnspecFnMapLookupElemFnMapUpdateElemFnMapDeleteElemFnProbeReadFnKtimeGetNsFnTracePrintkFnGetPrandomU32FnGetSmpProcessorIdFnSkbStoreBytesFnL3CsumReplaceFnL4CsumReplaceFnTailCallFnCloneRedirectFnGetCurrentPidTgidFnGetCurrentUidGidFnGetCurrentCommFnGetCgroupClassidFnSkbVlanPushFnSkbVlanPopFnSkbGetTunnelKeyFnSkbSetTunnelKeyFnPerfEventReadFnRedirectFnGetRouteRealmFnPerfEventOutputFnSkbLoadBytesFnGetStackidFnCsumDiffFnSkbGetTunnelOptFnSkbSetTunnelOptFnSkbChangeProtoFnSkbChangeTypeFnSkbUnderCgroupFnGetHashRecalcFnGetCurrentTaskFnProbeWriteUserFnCurrentTaskUnderCgroupFnSkbChangeTailFnSkbPullDataFnCsumUpdateFnSetHashInvalidFnGetNumaNodeIdFnSkbChangeHeadFnXdpAdjustHeadFnProbeReadStrFnGetSocketCookieFnGetSocketUidFnSetHashFnSetsockoptFnSkbAdjustRoomFnRedirectMapFnSkRedirectMapFnSockMapUpdateFnXdpAdjustMetaFnPerfEventReadValueFnPerfProgReadValueFnGetsockoptFnOverrideReturnFnSockOpsCbFlagsSetFnMsgRedirectMapFnMsgApplyBytesFnMsgCorkBytesFnMsgPullDataFnBindFnXdpAdjustTailFnSkbGetXfrmStateFnGetStackFnSkbLoadBytesRelativeFnFibLookupFnSockHashUpdateFnMsgRedirectHashFnSkRedirectHashFnLwtPushEncapFnLwtSeg6StoreBytesFnLwtSeg6AdjustSrhFnLwtSeg6ActionFnRcRepeatFnRcKeydownFnSkbCgroupIdFnGetCurrentCgroupIdFnGetLocalStorageFnSkSelectReuseportFnSkbAncestorCgroupIdFnSkLookupTcpFnSkLookupUdpFnSkReleaseFnMapPushElemFnMapPopElemFnMapPeekElemFnMsgPushDataFnMsgPopDataFnRcPointerRelFnSpinLockFnSpinUnlockFnSkFullsockFnTcpSockFnSkbEcnSetCeFnGetListenerSockFnSkcLookupTcpFnTcpCheckSyncookieFnSysctlGetNameFnSysctlGetCurrentValueFnSysctlGetNewValueFnSysctlSetNewValueFnStrtolFnStrtoulFnSkStorageGetFnSkStorageDeleteFnSendSignalFnTcpGenSyncookieFnSkbOutputFnProbeReadUserFnProbeReadKernelFnProbeReadUserStrFnProbeReadKernelStrFnTcpSendAckFnSendSignalThreadFnJiffies64FnReadBranchRecordsFnGetNsCurrentPidTgidFnXdpOutputFnGetNetnsCookieFnGetCurrentAncestorCgroupIdFnSkAssignFnKtimeGetBootNsFnSeqPrintfFnSeqWriteFnSkCgroupIdFnSkAncestorCgroupIdFnRingbufOutputFnRingbufReserveFnRingbufSubmitFnRingbufDiscardFnRingbufQueryFnCsumLevelFnSkcToTcp6SockFnSkcToTcpSockFnSkcToTcpTimewaitSockFnSkcToTcpRequestSockFnSkcToUdp6SockFnGetTaskStackFnLoadHdrOptFnStoreHdrOptFnReserveHdrOptFnInodeStorageGetFnInodeStorageDeleteFnDPathFnCopyFromUserFnSnprintfBtfFnSeqPrintfBtfFnSkbCgroupClassidFnRedirectNeighFnPerCpuPtrFnThisCpuPtrFnRedirectPeerFnTaskStorageGetFnTaskStorageDeleteFnGetCurrentTaskBtfFnBprmOptsSetFnKtimeGetCoarseNsFnImaInodeHashFnSockFromFileFnCheckMtuFnForEachMapElemFnSnprintfFnSysBpfFnBtfFindByNameKindFnSysCloseFnTimerInitFnTimerSetCallbackFnTimerStartFnTimerCancelFnGetFuncIpFnGetAttachCookieFnTaskPtRegsFnGetBranchSnapshotFnTraceVprintkFnSkcToUnixSockFnKallsymsLookupNameFnFindVmaFnLoopFnStrncmpFnGetFuncArgFnGetFuncRetFnGetFuncArgCntFnGetRetvalFnSetRetvalFnXdpGetBuffLenFnXdpLoadBytesFnXdpStoreBytesFnCopyFromUserTaskFnSkbSetTstampFnImaFileHashFnKptrXchgFnMapLookupPercpuElemFnSkcToMptcpSockFnDynptrFromMemFnRingbufReserveDynptrFnRingbufSubmitDynptrFnRingbufDiscardDynptrFnDynptrReadFnDynptrWriteFnDynptrDataFnTcpRawGenSyncookieIpv4FnTcpRawGenSyncookieIpv6FnTcpRawCheckSyncookieIpv4FnTcpRawCheckSyncookieIpv6FnKtimeGetTaiNsFnUserRingbufDrainFnCgrpStorageGetFnCgrpStorageDelete"
+	_BuiltinFunc_name_1 = "WindowsFnMapLookupElemWindowsFnMapUpdateElemWindowsFnMapDeleteElemWindowsFnMapLookupAndDeleteElemWindowsFnTailCallWindowsFnGetPrandomU32WindowsFnKtimeGetBootNsWindowsFnGetSmpProcessorIdWindowsFnKtimeGetNsWindowsFnCsumDiffWindowsFnRingbufOutputWindowsFnTracePrintk2WindowsFnTracePrintk3WindowsFnTracePrintk4WindowsFnTracePrintk5WindowsFnMapPushElemWindowsFnMapPopElemWindowsFnMapPeekElemWindowsFnGetCurrentPidTgidWindowsFnGetCurrentLogonIdWindowsFnIsCurrentAdminWindowsFnMemcpyWindowsFnMemcmpWindowsFnMemsetWindowsFnMemmoveWindowsFnGetSocketCookieWindowsFnStrncpySWindowsFnStrncatSWindowsFnStrnlenSWindowsFnKtimeGetBootMsWindowsFnKtimeGetMs"
+)
 
-var _BuiltinFunc_index = [...]uint16{0, 8, 23, 38, 53, 64, 76, 89, 104, 123, 138, 153, 168, 178, 193, 212, 230, 246, 264, 277, 289, 306, 323, 338, 348, 363, 380, 394, 406, 416, 433, 450, 466, 481, 497, 512, 528, 544, 568, 583, 596, 608, 624, 639, 654, 669, 683, 700, 714, 723, 735, 750, 763, 778, 793, 808, 828, 847, 859, 875, 894, 910, 925, 939, 952, 958, 973, 990, 1000, 1022, 1033, 1049, 1066, 1082, 1096, 1115, 1133, 1148, 1158, 1169, 1182, 1202, 1219, 1238, 1259, 1272, 1285, 1296, 1309, 1321, 1334, 1347, 1359, 1373, 1383, 1395, 1407, 1416, 1429, 1446, 1460, 1479, 1494, 1517, 1536, 1555, 1563, 1572, 1586, 1603, 1615, 1632, 1643, 1658, 1675, 1693, 1713, 1725, 1743, 1754, 1773, 1794, 1805, 1821, 1849, 1859, 1875, 1886, 1896, 1908, 1928, 1943, 1959, 1974, 1990, 2004, 2015, 2030, 2044, 2066, 2087, 2102, 2116, 2128, 2141, 2156, 2173, 2193, 2200, 2214, 2227, 2241, 2259, 2274, 2285, 2297, 2311, 2327, 2346, 2365, 2378, 2396, 2410, 2424, 2434, 2450, 2460, 2468, 2487, 2497, 2508, 2526, 2538, 2551, 2562, 2579, 2591, 2610, 2624, 2639, 2659, 2668, 2674, 2683, 2695, 2707, 2722, 2733, 2744, 2759, 2773, 2788, 2806, 2820, 2833, 2843, 2864, 2880, 2895, 2917, 2938, 2960, 2972, 2985, 2997, 3021, 3045, 3071, 3097, 3112, 3130, 3146, 3165}
+var (
+	_BuiltinFunc_index_0 = [...]uint16{0, 8, 23, 38, 53, 64, 76, 89, 104, 123, 138, 153, 168, 178, 193, 212, 230, 246, 264, 277, 289, 306, 323, 338, 348, 363, 380, 394, 406, 416, 433, 450, 466, 481, 497, 512, 528, 544, 568, 583, 596, 608, 624, 639, 654, 669, 683, 700, 714, 723, 735, 750, 763, 778, 793, 808, 828, 847, 859, 875, 894, 910, 925, 939, 952, 958, 973, 990, 1000, 1022, 1033, 1049, 1066, 1082, 1096, 1115, 1133, 1148, 1158, 1169, 1182, 1202, 1219, 1238, 1259, 1272, 1285, 1296, 1309, 1321, 1334, 1347, 1359, 1373, 1383, 1395, 1407, 1416, 1429, 1446, 1460, 1479, 1494, 1517, 1536, 1555, 1563, 1572, 1586, 1603, 1615, 1632, 1643, 1658, 1675, 1693, 1713, 1725, 1743, 1754, 1773, 1794, 1805, 1821, 1849, 1859, 1875, 1886, 1896, 1908, 1928, 1943, 1959, 1974, 1990, 2004, 2015, 2030, 2044, 2066, 2087, 2102, 2116, 2128, 2141, 2156, 2173, 2193, 2200, 2214, 2227, 2241, 2259, 2274, 2285, 2297, 2311, 2327, 2346, 2365, 2378, 2396, 2410, 2424, 2434, 2450, 2460, 2468, 2487, 2497, 2508, 2526, 2538, 2551, 2562, 2579, 2591, 2610, 2624, 2639, 2659, 2668, 2674, 2683, 2695, 2707, 2722, 2733, 2744, 2759, 2773, 2788, 2806, 2820, 2833, 2843, 2864, 2880, 2895, 2917, 2938, 2960, 2972, 2985, 2997, 3021, 3045, 3071, 3097, 3112, 3130, 3146, 3165}
+	_BuiltinFunc_index_1 = [...]uint16{0, 22, 44, 66, 97, 114, 136, 159, 185, 204, 221, 243, 264, 285, 306, 327, 347, 366, 386, 412, 438, 461, 476, 491, 506, 522, 546, 563, 580, 597, 620, 639}
+)
 
 func (i BuiltinFunc) String() string {
-	if i < 0 || i >= BuiltinFunc(len(_BuiltinFunc_index)-1) {
+	switch {
+	case i <= 211:
+		return _BuiltinFunc_name_0[_BuiltinFunc_index_0[i]:_BuiltinFunc_index_0[i+1]]
+	case 268435457 <= i && i <= 268435487:
+		i -= 268435457
+		return _BuiltinFunc_name_1[_BuiltinFunc_index_1[i]:_BuiltinFunc_index_1[i+1]]
+	default:
 		return "BuiltinFunc(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _BuiltinFunc_name[_BuiltinFunc_index[i]:_BuiltinFunc_index[i+1]]
 }
diff --git a/vendor/github.com/cilium/ebpf/asm/func_win.go b/vendor/github.com/cilium/ebpf/asm/func_win.go
new file mode 100644
index 0000000000000000000000000000000000000000..b016f008630b64c3ffba8a845f221f734e8a9f0f
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/asm/func_win.go
@@ -0,0 +1,44 @@
+// Code generated by internal/cmd/genwinfunctions.awk; DO NOT EDIT.
+
+package asm
+
+// Code in this file is derived from eBPF for Windows, available under the MIT License.
+
+import (
+	"github.com/cilium/ebpf/internal/platform"
+)
+
+// Built-in functions (Windows).
+const (
+	WindowsFnMapLookupElem          = BuiltinFunc(platform.WindowsTag | 1)
+	WindowsFnMapUpdateElem          = BuiltinFunc(platform.WindowsTag | 2)
+	WindowsFnMapDeleteElem          = BuiltinFunc(platform.WindowsTag | 3)
+	WindowsFnMapLookupAndDeleteElem = BuiltinFunc(platform.WindowsTag | 4)
+	WindowsFnTailCall               = BuiltinFunc(platform.WindowsTag | 5)
+	WindowsFnGetPrandomU32          = BuiltinFunc(platform.WindowsTag | 6)
+	WindowsFnKtimeGetBootNs         = BuiltinFunc(platform.WindowsTag | 7)
+	WindowsFnGetSmpProcessorId      = BuiltinFunc(platform.WindowsTag | 8)
+	WindowsFnKtimeGetNs             = BuiltinFunc(platform.WindowsTag | 9)
+	WindowsFnCsumDiff               = BuiltinFunc(platform.WindowsTag | 10)
+	WindowsFnRingbufOutput          = BuiltinFunc(platform.WindowsTag | 11)
+	WindowsFnTracePrintk2           = BuiltinFunc(platform.WindowsTag | 12)
+	WindowsFnTracePrintk3           = BuiltinFunc(platform.WindowsTag | 13)
+	WindowsFnTracePrintk4           = BuiltinFunc(platform.WindowsTag | 14)
+	WindowsFnTracePrintk5           = BuiltinFunc(platform.WindowsTag | 15)
+	WindowsFnMapPushElem            = BuiltinFunc(platform.WindowsTag | 16)
+	WindowsFnMapPopElem             = BuiltinFunc(platform.WindowsTag | 17)
+	WindowsFnMapPeekElem            = BuiltinFunc(platform.WindowsTag | 18)
+	WindowsFnGetCurrentPidTgid      = BuiltinFunc(platform.WindowsTag | 19)
+	WindowsFnGetCurrentLogonId      = BuiltinFunc(platform.WindowsTag | 20)
+	WindowsFnIsCurrentAdmin         = BuiltinFunc(platform.WindowsTag | 21)
+	WindowsFnMemcpy                 = BuiltinFunc(platform.WindowsTag | 22)
+	WindowsFnMemcmp                 = BuiltinFunc(platform.WindowsTag | 23)
+	WindowsFnMemset                 = BuiltinFunc(platform.WindowsTag | 24)
+	WindowsFnMemmove                = BuiltinFunc(platform.WindowsTag | 25)
+	WindowsFnGetSocketCookie        = BuiltinFunc(platform.WindowsTag | 26)
+	WindowsFnStrncpyS               = BuiltinFunc(platform.WindowsTag | 27)
+	WindowsFnStrncatS               = BuiltinFunc(platform.WindowsTag | 28)
+	WindowsFnStrnlenS               = BuiltinFunc(platform.WindowsTag | 29)
+	WindowsFnKtimeGetBootMs         = BuiltinFunc(platform.WindowsTag | 30)
+	WindowsFnKtimeGetMs             = BuiltinFunc(platform.WindowsTag | 31)
+)
diff --git a/vendor/github.com/cilium/ebpf/asm/instruction.go b/vendor/github.com/cilium/ebpf/asm/instruction.go
index 86b384c02a99844684fad5548f7852a32964d0af..10ca2547e991ed95a5675ba551953700a7937e7c 100644
--- a/vendor/github.com/cilium/ebpf/asm/instruction.go
+++ b/vendor/github.com/cilium/ebpf/asm/instruction.go
@@ -11,6 +11,8 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/sys"
 )
 
@@ -42,10 +44,10 @@ type Instruction struct {
 }
 
 // Unmarshal decodes a BPF instruction.
-func (ins *Instruction) Unmarshal(r io.Reader, bo binary.ByteOrder) (uint64, error) {
+func (ins *Instruction) Unmarshal(r io.Reader, bo binary.ByteOrder, platform string) error {
 	data := make([]byte, InstructionSize)
 	if _, err := io.ReadFull(r, data); err != nil {
-		return 0, err
+		return err
 	}
 
 	ins.OpCode = OpCode(data[0])
@@ -60,7 +62,13 @@ func (ins *Instruction) Unmarshal(r io.Reader, bo binary.ByteOrder) (uint64, err
 
 	ins.Offset = int16(bo.Uint16(data[2:4]))
 
-	if ins.OpCode.Class().IsALU() {
+	if ins.IsBuiltinCall() {
+		fn, err := BuiltinFuncForPlatform(platform, uint32(ins.Constant))
+		if err != nil {
+			return err
+		}
+		ins.Constant = int64(fn)
+	} else if ins.OpCode.Class().IsALU() {
 		switch ins.OpCode.ALUOp() {
 		case Div:
 			if ins.Offset == 1 {
@@ -92,26 +100,26 @@ func (ins *Instruction) Unmarshal(r io.Reader, bo binary.ByteOrder) (uint64, err
 	ins.Constant = int64(int32(bo.Uint32(data[4:8])))
 
 	if !ins.OpCode.IsDWordLoad() {
-		return InstructionSize, nil
+		return nil
 	}
 
 	// Pull another instruction from the stream to retrieve the second
 	// half of the 64-bit immediate value.
 	if _, err := io.ReadFull(r, data); err != nil {
 		// No Wrap, to avoid io.EOF clash
-		return 0, errors.New("64bit immediate is missing second half")
+		return errors.New("64bit immediate is missing second half")
 	}
 
 	// Require that all fields other than the value are zero.
 	if bo.Uint32(data[0:4]) != 0 {
-		return 0, errors.New("64bit immediate has non-zero fields")
+		return errors.New("64bit immediate has non-zero fields")
 	}
 
 	cons1 := uint32(ins.Constant)
 	cons2 := int32(bo.Uint32(data[4:8]))
 	ins.Constant = int64(cons2)<<32 | int64(cons1)
 
-	return 2 * InstructionSize, nil
+	return nil
 }
 
 // Marshal encodes a BPF instruction.
@@ -133,7 +141,14 @@ func (ins Instruction) Marshal(w io.Writer, bo binary.ByteOrder) (uint64, error)
 		return 0, fmt.Errorf("can't marshal registers: %s", err)
 	}
 
-	if ins.OpCode.Class().IsALU() {
+	if ins.IsBuiltinCall() {
+		fn := BuiltinFunc(ins.Constant)
+		plat, value := platform.DecodeConstant(fn)
+		if plat != platform.Native {
+			return 0, fmt.Errorf("function %s (%s): %w", fn, plat, internal.ErrNotSupportedOnOS)
+		}
+		cons = int32(value)
+	} else if ins.OpCode.Class().IsALU() {
 		newOffset := int16(0)
 		switch ins.OpCode.ALUOp() {
 		case SDiv:
@@ -529,29 +544,24 @@ type FDer interface {
 // Instructions is an eBPF program.
 type Instructions []Instruction
 
-// Unmarshal unmarshals an Instructions from a binary instruction stream.
-// All instructions in insns are replaced by instructions decoded from r.
-func (insns *Instructions) Unmarshal(r io.Reader, bo binary.ByteOrder) error {
-	if len(*insns) > 0 {
-		*insns = nil
-	}
-
+// AppendInstructions decodes [Instruction] from r and appends them to insns.
+func AppendInstructions(insns Instructions, r io.Reader, bo binary.ByteOrder, platform string) (Instructions, error) {
 	var offset uint64
 	for {
 		var ins Instruction
-		n, err := ins.Unmarshal(r, bo)
+		err := ins.Unmarshal(r, bo, platform)
 		if errors.Is(err, io.EOF) {
 			break
 		}
 		if err != nil {
-			return fmt.Errorf("offset %d: %w", offset, err)
+			return nil, fmt.Errorf("offset %d: %w", offset, err)
 		}
 
-		*insns = append(*insns, ins)
-		offset += n
+		insns = append(insns, ins)
+		offset += ins.Size()
 	}
 
-	return nil
+	return insns, nil
 }
 
 // Name returns the name of the function insns belongs to, if any.
diff --git a/vendor/github.com/cilium/ebpf/attachtype_string.go b/vendor/github.com/cilium/ebpf/attachtype_string.go
index 84445a325621fa8cb65374f65dc11e4c72dde554..efed516b621a97ebf1203aef877a5eb189911b02 100644
--- a/vendor/github.com/cilium/ebpf/attachtype_string.go
+++ b/vendor/github.com/cilium/ebpf/attachtype_string.go
@@ -66,15 +66,35 @@ func _() {
 	_ = x[AttachCgroupUnixGetsockname-53]
 	_ = x[AttachNetkitPrimary-54]
 	_ = x[AttachNetkitPeer-55]
+	_ = x[AttachWindowsXDP-268435457]
+	_ = x[AttachWindowsBind-268435458]
+	_ = x[AttachWindowsCGroupInet4Connect-268435459]
+	_ = x[AttachWindowsCGroupInet6Connect-268435460]
+	_ = x[AttachWindowsCgroupInet4RecvAccept-268435461]
+	_ = x[AttachWindowsCgroupInet6RecvAccept-268435462]
+	_ = x[AttachWindowsCGroupSockOps-268435463]
+	_ = x[AttachWindowsSample-268435464]
+	_ = x[AttachWindowsXDPTest-268435465]
 }
 
-const _AttachType_name = "NoneCGroupInetEgressCGroupInetSockCreateCGroupSockOpsSkSKBStreamParserSkSKBStreamVerdictCGroupDeviceSkMsgVerdictCGroupInet4BindCGroupInet6BindCGroupInet4ConnectCGroupInet6ConnectCGroupInet4PostBindCGroupInet6PostBindCGroupUDP4SendmsgCGroupUDP6SendmsgLircMode2FlowDissectorCGroupSysctlCGroupUDP4RecvmsgCGroupUDP6RecvmsgCGroupGetsockoptCGroupSetsockoptTraceRawTpTraceFEntryTraceFExitModifyReturnLSMMacTraceIterCgroupInet4GetPeernameCgroupInet6GetPeernameCgroupInet4GetSocknameCgroupInet6GetSocknameXDPDevMapCgroupInetSockReleaseXDPCPUMapSkLookupXDPSkSKBVerdictSkReuseportSelectSkReuseportSelectOrMigratePerfEventTraceKprobeMultiLSMCgroupStructOpsNetfilterTCXIngressTCXEgressTraceUprobeMultiCgroupUnixConnectCgroupUnixSendmsgCgroupUnixRecvmsgCgroupUnixGetpeernameCgroupUnixGetsocknameNetkitPrimaryNetkitPeerTraceKprobeSession"
+const (
+	_AttachType_name_0 = "NoneCGroupInetEgressCGroupInetSockCreateCGroupSockOpsSkSKBStreamParserSkSKBStreamVerdictCGroupDeviceSkMsgVerdictCGroupInet4BindCGroupInet6BindCGroupInet4ConnectCGroupInet6ConnectCGroupInet4PostBindCGroupInet6PostBindCGroupUDP4SendmsgCGroupUDP6SendmsgLircMode2FlowDissectorCGroupSysctlCGroupUDP4RecvmsgCGroupUDP6RecvmsgCGroupGetsockoptCGroupSetsockoptTraceRawTpTraceFEntryTraceFExitModifyReturnLSMMacTraceIterCgroupInet4GetPeernameCgroupInet6GetPeernameCgroupInet4GetSocknameCgroupInet6GetSocknameXDPDevMapCgroupInetSockReleaseXDPCPUMapSkLookupXDPSkSKBVerdictSkReuseportSelectSkReuseportSelectOrMigratePerfEventTraceKprobeMultiLSMCgroupStructOpsNetfilterTCXIngressTCXEgressTraceUprobeMultiCgroupUnixConnectCgroupUnixSendmsgCgroupUnixRecvmsgCgroupUnixGetpeernameCgroupUnixGetsocknameNetkitPrimaryNetkitPeerTraceKprobeSession"
+	_AttachType_name_1 = "WindowsXDPWindowsBindWindowsCGroupInet4ConnectWindowsCGroupInet6ConnectWindowsCgroupInet4RecvAcceptWindowsCgroupInet6RecvAcceptWindowsCGroupSockOpsWindowsSampleWindowsXDPTest"
+)
 
-var _AttachType_index = [...]uint16{0, 4, 20, 40, 53, 70, 88, 100, 112, 127, 142, 160, 178, 197, 216, 233, 250, 259, 272, 284, 301, 318, 334, 350, 360, 371, 381, 393, 399, 408, 430, 452, 474, 496, 505, 526, 535, 543, 546, 558, 575, 601, 610, 626, 635, 644, 653, 663, 672, 688, 705, 722, 739, 760, 781, 794, 804, 822}
+var (
+	_AttachType_index_0 = [...]uint16{0, 4, 20, 40, 53, 70, 88, 100, 112, 127, 142, 160, 178, 197, 216, 233, 250, 259, 272, 284, 301, 318, 334, 350, 360, 371, 381, 393, 399, 408, 430, 452, 474, 496, 505, 526, 535, 543, 546, 558, 575, 601, 610, 626, 635, 644, 653, 663, 672, 688, 705, 722, 739, 760, 781, 794, 804, 822}
+	_AttachType_index_1 = [...]uint8{0, 10, 21, 46, 71, 99, 127, 147, 160, 174}
+)
 
 func (i AttachType) String() string {
-	if i >= AttachType(len(_AttachType_index)-1) {
+	switch {
+	case i <= 56:
+		return _AttachType_name_0[_AttachType_index_0[i]:_AttachType_index_0[i+1]]
+	case 268435457 <= i && i <= 268435465:
+		i -= 268435457
+		return _AttachType_name_1[_AttachType_index_1[i]:_AttachType_index_1[i+1]]
+	default:
 		return "AttachType(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _AttachType_name[_AttachType_index[i]:_AttachType_index[i+1]]
 }
diff --git a/vendor/github.com/cilium/ebpf/btf/btf.go b/vendor/github.com/cilium/ebpf/btf/btf.go
index e8f80c1399776a39c29e544a395d8781e64b068f..eb5a23cda941559bbf30bbd8bfc7a1fd6edaaeb8 100644
--- a/vendor/github.com/cilium/ebpf/btf/btf.go
+++ b/vendor/github.com/cilium/ebpf/btf/btf.go
@@ -537,7 +537,7 @@ func (s *Spec) Copy() *Spec {
 	}
 
 	return &Spec{
-		s.mutableTypes.copy(),
+		s.copy(),
 		s.strings,
 	}
 }
@@ -579,7 +579,7 @@ func (s *Spec) TypeByID(id TypeID) (Type, error) {
 //
 // Returns an error wrapping [ErrNotFound] if the type isn't part of the Spec.
 func (s *Spec) TypeID(typ Type) (TypeID, error) {
-	return s.mutableTypes.typeID(typ)
+	return s.typeID(typ)
 }
 
 // AnyTypesByName returns a list of BTF Types with the given name.
@@ -590,7 +590,7 @@ func (s *Spec) TypeID(typ Type) (TypeID, error) {
 //
 // Returns an error wrapping ErrNotFound if no matching Type exists in the Spec.
 func (s *Spec) AnyTypesByName(name string) ([]Type, error) {
-	return s.mutableTypes.anyTypesByName(name)
+	return s.anyTypesByName(name)
 }
 
 // AnyTypeByName returns a Type with the given name.
diff --git a/vendor/github.com/cilium/ebpf/btf/core.go b/vendor/github.com/cilium/ebpf/btf/core.go
index ee89f98331a48873abe68d4f22eda63a1642dfd5..652516a0c91844de6f03d3ca83026e1fa78e2364 100644
--- a/vendor/github.com/cilium/ebpf/btf/core.go
+++ b/vendor/github.com/cilium/ebpf/btf/core.go
@@ -11,6 +11,8 @@ import (
 	"strings"
 
 	"github.com/cilium/ebpf/asm"
+	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/platform"
 )
 
 // Code in this file is derived from libbpf, which is available under a BSD
@@ -46,6 +48,10 @@ func (f *COREFixup) String() string {
 }
 
 func (f *COREFixup) Apply(ins *asm.Instruction) error {
+	if !platform.IsLinux {
+		return fmt.Errorf("CO-RE fixup: %w", internal.ErrNotSupportedOnOS)
+	}
+
 	if f.poison {
 		// Relocation is poisoned, replace the instruction with an invalid one.
 		if ins.OpCode.IsDWordLoad() {
diff --git a/vendor/github.com/cilium/ebpf/btf/feature.go b/vendor/github.com/cilium/ebpf/btf/feature.go
index e71c707fe4db9cd35c9260cde19fa595840870bf..5b427f5d3501d182994ef017b2e7a779001cca66 100644
--- a/vendor/github.com/cilium/ebpf/btf/feature.go
+++ b/vendor/github.com/cilium/ebpf/btf/feature.go
@@ -146,7 +146,7 @@ func probeBTF(typ Type) error {
 	}
 
 	fd, err := sys.BtfLoad(&sys.BtfLoadAttr{
-		Btf:     sys.NewSlicePointer(buf),
+		Btf:     sys.SlicePointer(buf),
 		BtfSize: uint32(len(buf)),
 	})
 
diff --git a/vendor/github.com/cilium/ebpf/btf/handle.go b/vendor/github.com/cilium/ebpf/btf/handle.go
index adfa6fed4bc3642b1046debd373568611ec0e31f..2e483e9d90c4368e4bec83248e74207e47ec4b82 100644
--- a/vendor/github.com/cilium/ebpf/btf/handle.go
+++ b/vendor/github.com/cilium/ebpf/btf/handle.go
@@ -8,6 +8,7 @@ import (
 	"os"
 
 	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/sys"
 	"github.com/cilium/ebpf/internal/unix"
 )
@@ -43,12 +44,16 @@ func NewHandle(b *Builder) (*Handle, error) {
 func NewHandleFromRawBTF(btf []byte) (*Handle, error) {
 	const minLogSize = 64 * 1024
 
+	if platform.IsWindows {
+		return nil, fmt.Errorf("btf: handle: %w", internal.ErrNotSupportedOnOS)
+	}
+
 	if uint64(len(btf)) > math.MaxUint32 {
 		return nil, errors.New("BTF exceeds the maximum size")
 	}
 
 	attr := &sys.BtfLoadAttr{
-		Btf:     sys.NewSlicePointer(btf),
+		Btf:     sys.SlicePointer(btf),
 		BtfSize: uint32(len(btf)),
 	}
 
@@ -91,7 +96,7 @@ func NewHandleFromRawBTF(btf []byte) (*Handle, error) {
 
 		logBuf = make([]byte, logSize)
 		attr.BtfLogSize = logSize
-		attr.BtfLogBuf = sys.NewSlicePointer(logBuf)
+		attr.BtfLogBuf = sys.SlicePointer(logBuf)
 		attr.BtfLogLevel = 1
 	}
 
@@ -110,6 +115,10 @@ func NewHandleFromRawBTF(btf []byte) (*Handle, error) {
 //
 // Requires CAP_SYS_ADMIN.
 func NewHandleFromID(id ID) (*Handle, error) {
+	if platform.IsWindows {
+		return nil, fmt.Errorf("btf: handle: %w", internal.ErrNotSupportedOnOS)
+	}
+
 	fd, err := sys.BtfGetFdById(&sys.BtfGetFdByIdAttr{
 		Id: uint32(id),
 	})
@@ -133,7 +142,8 @@ func NewHandleFromID(id ID) (*Handle, error) {
 func (h *Handle) Spec(base *Spec) (*Spec, error) {
 	var btfInfo sys.BtfInfo
 	btfBuffer := make([]byte, h.size)
-	btfInfo.Btf, btfInfo.BtfSize = sys.NewSlicePointerLen(btfBuffer)
+	btfInfo.Btf = sys.SlicePointer(btfBuffer)
+	btfInfo.BtfSize = uint32(len(btfBuffer))
 
 	if err := sys.ObjInfo(h.fd, &btfInfo); err != nil {
 		return nil, err
@@ -204,7 +214,8 @@ func newHandleInfoFromFD(fd *sys.FD) (*HandleInfo, error) {
 	btfInfo.BtfSize = 0
 
 	nameBuffer := make([]byte, btfInfo.NameLen)
-	btfInfo.Name, btfInfo.NameLen = sys.NewSlicePointerLen(nameBuffer)
+	btfInfo.Name = sys.SlicePointer(nameBuffer)
+	btfInfo.NameLen = uint32(len(nameBuffer))
 	if err := sys.ObjInfo(fd, &btfInfo); err != nil {
 		return nil, err
 	}
@@ -242,6 +253,11 @@ type HandleIterator struct {
 // Returns true if another BTF object was found. Call [HandleIterator.Err] after
 // the function returns false.
 func (it *HandleIterator) Next() bool {
+	if platform.IsWindows {
+		it.err = fmt.Errorf("btf: %w", internal.ErrNotSupportedOnOS)
+		return false
+	}
+
 	id := it.ID
 	for {
 		attr := &sys.BtfGetNextIdAttr{Id: id}
diff --git a/vendor/github.com/cilium/ebpf/btf/kernel.go b/vendor/github.com/cilium/ebpf/btf/kernel.go
index 1a9321f054c7c5bbd38f003bd6cb3c0562c3dad5..11cb4a9c993e5efbd512cb749952609c1b0a5dea 100644
--- a/vendor/github.com/cilium/ebpf/btf/kernel.go
+++ b/vendor/github.com/cilium/ebpf/btf/kernel.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/cilium/ebpf/internal"
 	"github.com/cilium/ebpf/internal/linux"
+	"github.com/cilium/ebpf/internal/platform"
 )
 
 var kernelBTF = struct {
@@ -85,7 +86,7 @@ func LoadKernelModuleSpec(module string) (*Spec, error) {
 
 	spec, err = loadKernelModuleSpec(module, base)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("load kernel module: %w", err)
 	}
 
 	kernelBTF.modules[module] = spec
@@ -93,6 +94,10 @@ func LoadKernelModuleSpec(module string) (*Spec, error) {
 }
 
 func loadKernelSpec() (_ *Spec, fallback bool, _ error) {
+	if platform.IsWindows {
+		return nil, false, internal.ErrNotSupportedOnOS
+	}
+
 	fh, err := os.Open("/sys/kernel/btf/vmlinux")
 	if err == nil {
 		defer fh.Close()
@@ -112,6 +117,10 @@ func loadKernelSpec() (_ *Spec, fallback bool, _ error) {
 }
 
 func loadKernelModuleSpec(module string, base *Spec) (*Spec, error) {
+	if platform.IsWindows {
+		return nil, internal.ErrNotSupportedOnOS
+	}
+
 	dir, file := filepath.Split(module)
 	if dir != "" || filepath.Ext(file) != "" {
 		return nil, fmt.Errorf("invalid module name %q", module)
@@ -128,6 +137,10 @@ func loadKernelModuleSpec(module string, base *Spec) (*Spec, error) {
 
 // findVMLinux scans multiple well-known paths for vmlinux kernel images.
 func findVMLinux() (*os.File, error) {
+	if platform.IsWindows {
+		return nil, fmt.Errorf("find vmlinux: %w", internal.ErrNotSupportedOnOS)
+	}
+
 	release, err := linux.KernelRelease()
 	if err != nil {
 		return nil, err
diff --git a/vendor/github.com/cilium/ebpf/btf/marshal.go b/vendor/github.com/cilium/ebpf/btf/marshal.go
index d7204e62476be82094457f07f4a180e935a638d6..585ef4a442c70f3867a80db649be78148a865c16 100644
--- a/vendor/github.com/cilium/ebpf/btf/marshal.go
+++ b/vendor/github.com/cilium/ebpf/btf/marshal.go
@@ -243,28 +243,27 @@ func (b *Builder) addString(str string) (uint32, error) {
 	return b.strings.Add(str)
 }
 
-func (e *encoder) allocateIDs(root Type) (err error) {
-	visitInPostorder(root, e.visited, func(typ Type) bool {
+func (e *encoder) allocateIDs(root Type) error {
+	for typ := range postorder(root, e.visited) {
 		if _, ok := typ.(*Void); ok {
-			return true
+			continue
 		}
 
 		if _, ok := e.ids[typ]; ok {
-			return true
+			continue
 		}
 
 		id := e.lastID + 1
 		if id < e.lastID {
-			err = errors.New("type ID overflow")
-			return false
+			return errors.New("type ID overflow")
 		}
 
 		e.pending.Push(typ)
 		e.ids[typ] = id
 		e.lastID = id
-		return true
-	})
-	return
+	}
+
+	return nil
 }
 
 // id returns the ID for the given type or panics with an error.
diff --git a/vendor/github.com/cilium/ebpf/btf/traversal.go b/vendor/github.com/cilium/ebpf/btf/traversal.go
index 13647d931ffc6ef042fe8172239df53f49833806..57c1dc27e84e9a6fc2d3b7fdb83bb040759de9d4 100644
--- a/vendor/github.com/cilium/ebpf/btf/traversal.go
+++ b/vendor/github.com/cilium/ebpf/btf/traversal.go
@@ -2,16 +2,21 @@ package btf
 
 import (
 	"fmt"
+	"iter"
 )
 
 // Functions to traverse a cyclic graph of types. The below was very useful:
 // https://eli.thegreenplace.net/2015/directed-graph-traversal-orderings-and-applications-to-data-flow-analysis/#post-order-and-reverse-post-order
 
-// Visit all types reachable from root in postorder.
-//
-// Traversal stops if yield returns false.
-//
-// Returns false if traversal was aborted.
+// postorder yields all types reachable from root in post order.
+func postorder(root Type, visited map[Type]struct{}) iter.Seq[Type] {
+	return func(yield func(Type) bool) {
+		visitInPostorder(root, visited, yield)
+	}
+}
+
+// visitInPostorder is a separate function to avoid arguments escaping
+// to the heap. Don't change the setup without re-running the benchmarks.
 func visitInPostorder(root Type, visited map[Type]struct{}, yield func(typ Type) bool) bool {
 	if _, ok := visited[root]; ok {
 		return true
@@ -21,139 +26,134 @@ func visitInPostorder(root Type, visited map[Type]struct{}, yield func(typ Type)
 	}
 	visited[root] = struct{}{}
 
-	cont := children(root, func(child *Type) bool {
-		return visitInPostorder(*child, visited, yield)
-	})
-	if !cont {
-		return false
+	for child := range children(root) {
+		if !visitInPostorder(*child, visited, yield) {
+			return false
+		}
 	}
 
 	return yield(root)
 }
 
-// children calls yield on each child of typ.
-//
-// Traversal stops if yield returns false.
-//
-// Returns false if traversal was aborted.
-func children(typ Type, yield func(child *Type) bool) bool {
-	// Explicitly type switch on the most common types to allow the inliner to
-	// do its work. This avoids allocating intermediate slices from walk() on
-	// the heap.
-	var tags []string
-	switch v := typ.(type) {
-	case *Void, *Int, *Enum, *Fwd, *Float, *declTag:
-		// No children to traverse.
-		// declTags is declared as a leaf type since it's parsed into .Tags fields of other types
-		// during unmarshaling.
-	case *Pointer:
-		if !yield(&v.Target) {
-			return false
-		}
-	case *Array:
-		if !yield(&v.Index) {
-			return false
-		}
-		if !yield(&v.Type) {
-			return false
-		}
-	case *Struct:
-		for i := range v.Members {
-			if !yield(&v.Members[i].Type) {
-				return false
-			}
-			for _, t := range v.Members[i].Tags {
-				var tag Type = &declTag{v, t, i}
-				if !yield(&tag) {
-					return false
-				}
+// children yields all direct descendants of typ.
+func children(typ Type) iter.Seq[*Type] {
+	return func(yield func(*Type) bool) {
+		// Explicitly type switch on the most common types to allow the inliner to
+		// do its work. This avoids allocating intermediate slices from walk() on
+		// the heap.
+		var tags []string
+		switch v := typ.(type) {
+		case *Void, *Int, *Enum, *Fwd, *Float, *declTag:
+			// No children to traverse.
+			// declTags is declared as a leaf type since it's parsed into .Tags fields of other types
+			// during unmarshaling.
+		case *Pointer:
+			if !yield(&v.Target) {
+				return
 			}
-		}
-		tags = v.Tags
-	case *Union:
-		for i := range v.Members {
-			if !yield(&v.Members[i].Type) {
-				return false
-			}
-			for _, t := range v.Members[i].Tags {
-				var tag Type = &declTag{v, t, i}
-				if !yield(&tag) {
-					return false
+		case *Array:
+			if !yield(&v.Index) {
+				return
+			}
+			if !yield(&v.Type) {
+				return
+			}
+		case *Struct:
+			for i := range v.Members {
+				if !yield(&v.Members[i].Type) {
+					return
+				}
+				for _, t := range v.Members[i].Tags {
+					var tag Type = &declTag{v, t, i}
+					if !yield(&tag) {
+						return
+					}
 				}
 			}
-		}
-		tags = v.Tags
-	case *Typedef:
-		if !yield(&v.Type) {
-			return false
-		}
-		tags = v.Tags
-	case *Volatile:
-		if !yield(&v.Type) {
-			return false
-		}
-	case *Const:
-		if !yield(&v.Type) {
-			return false
-		}
-	case *Restrict:
-		if !yield(&v.Type) {
-			return false
-		}
-	case *Func:
-		if !yield(&v.Type) {
-			return false
-		}
-		if fp, ok := v.Type.(*FuncProto); ok {
-			for i := range fp.Params {
-				if len(v.ParamTags) <= i {
-					continue
+			tags = v.Tags
+		case *Union:
+			for i := range v.Members {
+				if !yield(&v.Members[i].Type) {
+					return
 				}
-				for _, t := range v.ParamTags[i] {
+				for _, t := range v.Members[i].Tags {
 					var tag Type = &declTag{v, t, i}
 					if !yield(&tag) {
-						return false
+						return
 					}
 				}
 			}
-		}
-		tags = v.Tags
-	case *FuncProto:
-		if !yield(&v.Return) {
-			return false
-		}
-		for i := range v.Params {
-			if !yield(&v.Params[i].Type) {
-				return false
+			tags = v.Tags
+		case *Typedef:
+			if !yield(&v.Type) {
+				return
 			}
-		}
-	case *Var:
-		if !yield(&v.Type) {
-			return false
-		}
-		tags = v.Tags
-	case *Datasec:
-		for i := range v.Vars {
-			if !yield(&v.Vars[i].Type) {
-				return false
+			tags = v.Tags
+		case *Volatile:
+			if !yield(&v.Type) {
+				return
 			}
+		case *Const:
+			if !yield(&v.Type) {
+				return
+			}
+		case *Restrict:
+			if !yield(&v.Type) {
+				return
+			}
+		case *Func:
+			if !yield(&v.Type) {
+				return
+			}
+			if fp, ok := v.Type.(*FuncProto); ok {
+				for i := range fp.Params {
+					if len(v.ParamTags) <= i {
+						continue
+					}
+					for _, t := range v.ParamTags[i] {
+						var tag Type = &declTag{v, t, i}
+						if !yield(&tag) {
+							return
+						}
+					}
+				}
+			}
+			tags = v.Tags
+		case *FuncProto:
+			if !yield(&v.Return) {
+				return
+			}
+			for i := range v.Params {
+				if !yield(&v.Params[i].Type) {
+					return
+				}
+			}
+		case *Var:
+			if !yield(&v.Type) {
+				return
+			}
+			tags = v.Tags
+		case *Datasec:
+			for i := range v.Vars {
+				if !yield(&v.Vars[i].Type) {
+					return
+				}
+			}
+		case *TypeTag:
+			if !yield(&v.Type) {
+				return
+			}
+		case *cycle:
+			// cycle has children, but we ignore them deliberately.
+		default:
+			panic(fmt.Sprintf("don't know how to walk Type %T", v))
 		}
-	case *TypeTag:
-		if !yield(&v.Type) {
-			return false
-		}
-	case *cycle:
-		// cycle has children, but we ignore them deliberately.
-	default:
-		panic(fmt.Sprintf("don't know how to walk Type %T", v))
-	}
 
-	for _, t := range tags {
-		var tag Type = &declTag{typ, t, -1}
-		if !yield(&tag) {
-			return false
+		for _, t := range tags {
+			var tag Type = &declTag{typ, t, -1}
+			if !yield(&tag) {
+				return
+			}
 		}
 	}
-
-	return true
 }
diff --git a/vendor/github.com/cilium/ebpf/btf/types.go b/vendor/github.com/cilium/ebpf/btf/types.go
index dbcdf9dd7aac1fa1ece0cecc511367128061635e..638e7cf50808ce75bd920974c886ec5a44e4ee9f 100644
--- a/vendor/github.com/cilium/ebpf/btf/types.go
+++ b/vendor/github.com/cilium/ebpf/btf/types.go
@@ -740,10 +740,9 @@ func copyType(typ Type, ids map[Type]TypeID, copies map[Type]Type, copiedIDs map
 		copiedIDs[cpy] = id
 	}
 
-	children(cpy, func(child *Type) bool {
+	for child := range children(cpy) {
 		*child = copyType(*child, ids, copies, copiedIDs)
-		return true
-	})
+	}
 
 	return cpy
 }
diff --git a/vendor/github.com/cilium/ebpf/collection.go b/vendor/github.com/cilium/ebpf/collection.go
index a7b6cb31bf5dc8cdb07d44d53730870054873204..f8fdd9ebd386cba42955b1a7ba059f3e126275da 100644
--- a/vendor/github.com/cilium/ebpf/collection.go
+++ b/vendor/github.com/cilium/ebpf/collection.go
@@ -4,6 +4,7 @@ import (
 	"encoding/binary"
 	"errors"
 	"fmt"
+	"path/filepath"
 	"reflect"
 	"strings"
 
@@ -13,6 +14,7 @@ import (
 	"github.com/cilium/ebpf/internal/kallsyms"
 	"github.com/cilium/ebpf/internal/kconfig"
 	"github.com/cilium/ebpf/internal/linux"
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/sys"
 )
 
@@ -61,26 +63,34 @@ func (cs *CollectionSpec) Copy() *CollectionSpec {
 	}
 
 	cpy := CollectionSpec{
-		Maps:      make(map[string]*MapSpec, len(cs.Maps)),
-		Programs:  make(map[string]*ProgramSpec, len(cs.Programs)),
+		Maps:      copyMapOfSpecs(cs.Maps),
+		Programs:  copyMapOfSpecs(cs.Programs),
 		Variables: make(map[string]*VariableSpec, len(cs.Variables)),
 		ByteOrder: cs.ByteOrder,
 		Types:     cs.Types.Copy(),
 	}
 
-	for name, spec := range cs.Maps {
-		cpy.Maps[name] = spec.Copy()
+	for name, spec := range cs.Variables {
+		cpy.Variables[name] = spec.copy(&cpy)
 	}
+	if cs.Variables == nil {
+		cpy.Variables = nil
+	}
+
+	return &cpy
+}
 
-	for name, spec := range cs.Programs {
-		cpy.Programs[name] = spec.Copy()
+func copyMapOfSpecs[T interface{ Copy() T }](m map[string]T) map[string]T {
+	if m == nil {
+		return nil
 	}
 
-	for name, spec := range cs.Variables {
-		cpy.Variables[name] = spec.copy(&cpy)
+	cpy := make(map[string]T, len(m))
+	for k, v := range m {
+		cpy[k] = v.Copy()
 	}
 
-	return &cpy
+	return cpy
 }
 
 // RewriteMaps replaces all references to specific maps.
@@ -295,8 +305,7 @@ func (cs *CollectionSpec) LoadAndAssign(to interface{}, opts *CollectionOptions)
 
 	// Evaluate the loader's objects after all (lazy)loading has taken place.
 	for n, m := range loader.maps {
-		switch m.typ {
-		case ProgramArray:
+		if m.typ.canStoreProgram() {
 			// Require all lazy-loaded ProgramArrays to be assigned to the given object.
 			// The kernel empties a ProgramArray once the last user space reference
 			// to it closes, which leads to failed tail calls. Combined with the library
@@ -525,6 +534,7 @@ func (cl *collectionLoader) loadMap(mapName string) (*Map, error) {
 	// that need to be finalized before invoking the verifier.
 	if !mapSpec.Type.canStoreMapOrProgram() {
 		if err := m.finalize(mapSpec); err != nil {
+			_ = m.Close()
 			return nil, fmt.Errorf("finalizing map %s: %w", mapName, err)
 		}
 	}
@@ -702,6 +712,10 @@ func resolveKconfig(m *MapSpec) error {
 		return errors.New("map value is not a Datasec")
 	}
 
+	if platform.IsWindows {
+		return fmt.Errorf(".kconfig: %w", internal.ErrNotSupportedOnOS)
+	}
+
 	type configInfo struct {
 		offset uint32
 		size   uint32
@@ -794,6 +808,13 @@ func resolveKconfig(m *MapSpec) error {
 // Omitting Collection.Close() during application shutdown is an error.
 // See the package documentation for details around Map and Program lifecycle.
 func LoadCollection(file string) (*Collection, error) {
+	if platform.IsWindows {
+		// This mirrors a check in efW.
+		if ext := filepath.Ext(file); ext == ".sys" {
+			return loadCollectionFromNativeImage(file)
+		}
+	}
+
 	spec, err := LoadCollectionSpec(file)
 	if err != nil {
 		return nil, err
diff --git a/vendor/github.com/cilium/ebpf/collection_other.go b/vendor/github.com/cilium/ebpf/collection_other.go
new file mode 100644
index 0000000000000000000000000000000000000000..0e69bb83ac765e16f949fb08f450d89cc083c354
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/collection_other.go
@@ -0,0 +1,9 @@
+//go:build !windows
+
+package ebpf
+
+import "github.com/cilium/ebpf/internal"
+
+func loadCollectionFromNativeImage(_ string) (*Collection, error) {
+	return nil, internal.ErrNotSupportedOnOS
+}
diff --git a/vendor/github.com/cilium/ebpf/collection_windows.go b/vendor/github.com/cilium/ebpf/collection_windows.go
new file mode 100644
index 0000000000000000000000000000000000000000..c1bbaa21d1b6a98fda145fcb064ccba80ec97c02
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/collection_windows.go
@@ -0,0 +1,136 @@
+package ebpf
+
+import (
+	"errors"
+	"fmt"
+	"unsafe"
+
+	"github.com/cilium/ebpf/internal/efw"
+	"github.com/cilium/ebpf/internal/sys"
+	"github.com/cilium/ebpf/internal/unix"
+)
+
+func loadCollectionFromNativeImage(file string) (_ *Collection, err error) {
+	mapFds := make([]efw.FD, 16)
+	programFds := make([]efw.FD, 16)
+	var maps map[string]*Map
+	var programs map[string]*Program
+
+	defer func() {
+		if err == nil {
+			return
+		}
+
+		for _, fd := range append(mapFds, programFds...) {
+			// efW never uses fd 0.
+			if fd != 0 {
+				_ = efw.EbpfCloseFd(int(fd))
+			}
+		}
+
+		for _, m := range maps {
+			_ = m.Close()
+		}
+
+		for _, p := range programs {
+			_ = p.Close()
+		}
+	}()
+
+	nMaps, nPrograms, err := efw.EbpfObjectLoadNativeFds(file, mapFds, programFds)
+	if errors.Is(err, efw.EBPF_NO_MEMORY) && (nMaps > len(mapFds) || nPrograms > len(programFds)) {
+		mapFds = make([]efw.FD, nMaps)
+		programFds = make([]efw.FD, nPrograms)
+
+		nMaps, nPrograms, err = efw.EbpfObjectLoadNativeFds(file, mapFds, programFds)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	mapFds = mapFds[:nMaps]
+	programFds = programFds[:nPrograms]
+
+	// The maximum length of a name is only 16 bytes on Linux, longer names
+	// are truncated. This is not a problem when loading from an ELF, since
+	// we get the full object name from the symbol table.
+	// When loading a native image we do not have this luxury. Use an efW native
+	// API to retrieve up to 64 bytes of the object name.
+
+	maps = make(map[string]*Map, len(mapFds))
+	for _, raw := range mapFds {
+		fd, err := sys.NewFD(int(raw))
+		if err != nil {
+			return nil, err
+		}
+
+		m, mapErr := newMapFromFD(fd)
+		if mapErr != nil {
+			_ = fd.Close()
+			return nil, mapErr
+		}
+
+		var efwMapInfo efw.BpfMapInfo
+		size := uint32(unsafe.Sizeof(efwMapInfo))
+		_, err = efw.EbpfObjectGetInfoByFd(m.FD(), unsafe.Pointer(&efwMapInfo), &size)
+		if err != nil {
+			_ = m.Close()
+			return nil, err
+		}
+
+		if size >= uint32(unsafe.Offsetof(efwMapInfo.Name)+unsafe.Sizeof(efwMapInfo.Name)) {
+			m.name = unix.ByteSliceToString(efwMapInfo.Name[:])
+		}
+
+		if m.name == "" {
+			_ = m.Close()
+			return nil, fmt.Errorf("unnamed map")
+		}
+
+		if _, ok := maps[m.name]; ok {
+			return nil, fmt.Errorf("duplicate map with the same name: %s", m.name)
+		}
+
+		maps[m.name] = m
+	}
+
+	programs = make(map[string]*Program, len(programFds))
+	for _, raw := range programFds {
+		fd, err := sys.NewFD(int(raw))
+		if err != nil {
+			return nil, err
+		}
+
+		program, err := newProgramFromFD(fd)
+		if err != nil {
+			_ = fd.Close()
+			return nil, err
+		}
+
+		var efwProgInfo efw.BpfProgInfo
+		size := uint32(unsafe.Sizeof(efwProgInfo))
+		_, err = efw.EbpfObjectGetInfoByFd(program.FD(), unsafe.Pointer(&efwProgInfo), &size)
+		if err != nil {
+			_ = program.Close()
+			return nil, err
+		}
+
+		if size >= uint32(unsafe.Offsetof(efwProgInfo.Name)+unsafe.Sizeof(efwProgInfo.Name)) {
+			program.name = unix.ByteSliceToString(efwProgInfo.Name[:])
+		}
+
+		if program.name == "" {
+			_ = program.Close()
+			return nil, fmt.Errorf("unnamed program")
+		}
+
+		if _, ok := programs[program.name]; ok {
+			_ = program.Close()
+			return nil, fmt.Errorf("duplicate program with the same name: %s", program.name)
+		}
+
+		programs[program.name] = program
+	}
+
+	return &Collection{programs, maps, nil}, nil
+}
diff --git a/vendor/github.com/cilium/ebpf/cpu.go b/vendor/github.com/cilium/ebpf/cpu.go
index 07e959efdcb282f74648e6b3d43ac9c61917582c..3bcdc386db55853b0e60c0cde934899b7a61d5da 100644
--- a/vendor/github.com/cilium/ebpf/cpu.go
+++ b/vendor/github.com/cilium/ebpf/cpu.go
@@ -1,16 +1,5 @@
 package ebpf
 
-import (
-	"fmt"
-	"os"
-	"strings"
-	"sync"
-)
-
-var possibleCPU = sync.OnceValues(func() (int, error) {
-	return parseCPUsFromFile("/sys/devices/system/cpu/possible")
-})
-
 // PossibleCPU returns the max number of CPUs a system may possibly have
 // Logical CPU numbers must be of the form 0-n
 func PossibleCPU() (int, error) {
@@ -26,41 +15,3 @@ func MustPossibleCPU() int {
 	}
 	return cpus
 }
-
-func parseCPUsFromFile(path string) (int, error) {
-	spec, err := os.ReadFile(path)
-	if err != nil {
-		return 0, err
-	}
-
-	n, err := parseCPUs(string(spec))
-	if err != nil {
-		return 0, fmt.Errorf("can't parse %s: %v", path, err)
-	}
-
-	return n, nil
-}
-
-// parseCPUs parses the number of cpus from a string produced
-// by bitmap_list_string() in the Linux kernel.
-// Multiple ranges are rejected, since they can't be unified
-// into a single number.
-// This is the format of /sys/devices/system/cpu/possible, it
-// is not suitable for /sys/devices/system/cpu/online, etc.
-func parseCPUs(spec string) (int, error) {
-	if strings.Trim(spec, "\n") == "0" {
-		return 1, nil
-	}
-
-	var low, high int
-	n, err := fmt.Sscanf(spec, "%d-%d\n", &low, &high)
-	if n != 2 || err != nil {
-		return 0, fmt.Errorf("invalid format: %s", spec)
-	}
-	if low != 0 {
-		return 0, fmt.Errorf("CPU spec doesn't start at zero: %s", spec)
-	}
-
-	// cpus is 0 indexed
-	return high + 1, nil
-}
diff --git a/vendor/github.com/cilium/ebpf/cpu_other.go b/vendor/github.com/cilium/ebpf/cpu_other.go
new file mode 100644
index 0000000000000000000000000000000000000000..eca5164c1289924f22224d034c3f745d64ddff44
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/cpu_other.go
@@ -0,0 +1,13 @@
+//go:build !windows
+
+package ebpf
+
+import (
+	"sync"
+
+	"github.com/cilium/ebpf/internal/linux"
+)
+
+var possibleCPU = sync.OnceValues(func() (int, error) {
+	return linux.ParseCPUsFromFile("/sys/devices/system/cpu/possible")
+})
diff --git a/vendor/github.com/cilium/ebpf/cpu_windows.go b/vendor/github.com/cilium/ebpf/cpu_windows.go
new file mode 100644
index 0000000000000000000000000000000000000000..9448b09164161efdda642c12cde26d672c8f477b
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/cpu_windows.go
@@ -0,0 +1,11 @@
+package ebpf
+
+import (
+	"sync"
+
+	"golang.org/x/sys/windows"
+)
+
+var possibleCPU = sync.OnceValues(func() (int, error) {
+	return int(windows.GetMaximumProcessorCount(windows.ALL_PROCESSOR_GROUPS)), nil
+})
diff --git a/vendor/github.com/cilium/ebpf/elf_reader.go b/vendor/github.com/cilium/ebpf/elf_reader.go
index 9e8dbc7ae5a9094e0a78ff5c308c235e85ea5243..f83033c876006ecae16981074c17b3ad746df27f 100644
--- a/vendor/github.com/cilium/ebpf/elf_reader.go
+++ b/vendor/github.com/cilium/ebpf/elf_reader.go
@@ -15,6 +15,7 @@ import (
 	"github.com/cilium/ebpf/asm"
 	"github.com/cilium/ebpf/btf"
 	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/sys"
 )
 
@@ -79,8 +80,8 @@ func LoadCollectionSpecFromReader(rd io.ReaderAt) (*CollectionSpec, error) {
 
 	// Checks if the ELF file is for BPF data.
 	// Old LLVM versions set e_machine to EM_NONE.
-	if f.File.Machine != elf.EM_NONE && f.File.Machine != elf.EM_BPF {
-		return nil, fmt.Errorf("unexpected machine type for BPF ELF: %s", f.File.Machine)
+	if f.Machine != elf.EM_NONE && f.Machine != elf.EM_BPF {
+		return nil, fmt.Errorf("unexpected machine type for BPF ELF: %s", f.Machine)
 	}
 
 	var (
@@ -184,7 +185,13 @@ func LoadCollectionSpecFromReader(rd io.ReaderAt) (*CollectionSpec, error) {
 		return nil, fmt.Errorf("load programs: %w", err)
 	}
 
-	return &CollectionSpec{ec.maps, progs, ec.vars, btfSpec, ec.ByteOrder}, nil
+	return &CollectionSpec{
+		ec.maps,
+		progs,
+		ec.vars,
+		btfSpec,
+		ec.ByteOrder,
+	}, nil
 }
 
 func loadLicense(sec *elf.Section) (string, error) {
@@ -402,7 +409,8 @@ func (ec *elfCode) loadFunctions(section *elfSection) (map[string]asm.Instructio
 
 	// Decode the section's instruction stream.
 	insns := make(asm.Instructions, 0, section.Size/asm.InstructionSize)
-	if err := insns.Unmarshal(r, ec.ByteOrder); err != nil {
+	insns, err := asm.AppendInstructions(insns, r, ec.ByteOrder, platform.Linux)
+	if err != nil {
 		return nil, fmt.Errorf("decoding instructions for section %s: %w", section.Name, err)
 	}
 	if len(insns) == 0 {
@@ -734,7 +742,7 @@ func (ec *elfCode) loadMaps() error {
 			lr := io.LimitReader(r, int64(size))
 
 			spec := MapSpec{
-				Name: SanitizeName(mapName, -1),
+				Name: sanitizeName(mapName, -1),
 			}
 			switch {
 			case binary.Read(lr, ec.ByteOrder, &spec.Type) != nil:
@@ -1021,7 +1029,7 @@ func mapSpecFromBTF(es *elfSection, vs *btf.VarSecinfo, def *btf.Struct, spec *b
 	}
 
 	return &MapSpec{
-		Name:       SanitizeName(name, -1),
+		Name:       sanitizeName(name, -1),
 		Type:       MapType(mapType),
 		KeySize:    keySize,
 		ValueSize:  valueSize,
@@ -1087,7 +1095,7 @@ func resolveBTFValuesContents(es *elfSection, vs *btf.VarSecinfo, member btf.Mem
 	end := vs.Size + vs.Offset
 	// The size of an address in this section. This determines the width of
 	// an index in the array.
-	align := uint32(es.SectionHeader.Addralign)
+	align := uint32(es.Addralign)
 
 	// Check if variable-length section is aligned.
 	if (end-start)%align != 0 {
@@ -1148,7 +1156,7 @@ func (ec *elfCode) loadDataSections() error {
 		}
 
 		mapSpec := &MapSpec{
-			Name:       SanitizeName(sec.Name, -1),
+			Name:       sanitizeName(sec.Name, -1),
 			Type:       Array,
 			KeySize:    4,
 			ValueSize:  uint32(sec.Size),
diff --git a/vendor/github.com/cilium/ebpf/info.go b/vendor/github.com/cilium/ebpf/info.go
index 676e8fa6e74f192e7c7545b106555ee835dbe270..667b0cca60dc2575f9f19690e2d551139a86e83e 100644
--- a/vendor/github.com/cilium/ebpf/info.go
+++ b/vendor/github.com/cilium/ebpf/info.go
@@ -16,6 +16,7 @@ import (
 	"github.com/cilium/ebpf/asm"
 	"github.com/cilium/ebpf/btf"
 	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/sys"
 	"github.com/cilium/ebpf/internal/unix"
 )
@@ -74,8 +75,13 @@ func newMapInfoFromFd(fd *sys.FD) (*MapInfo, error) {
 		return nil, fmt.Errorf("getting object info: %w", err1)
 	}
 
+	typ, err := MapTypeForPlatform(platform.Native, info.Type)
+	if err != nil {
+		return nil, fmt.Errorf("map type: %w", err)
+	}
+
 	mi := &MapInfo{
-		MapType(info.Type),
+		typ,
 		info.KeySize,
 		info.ValueSize,
 		info.MaxEntries,
@@ -105,8 +111,9 @@ func newMapInfoFromFd(fd *sys.FD) (*MapInfo, error) {
 // readMapInfoFromProc queries map information about the given fd from
 // /proc/self/fdinfo. It only writes data into fields that have a zero value.
 func readMapInfoFromProc(fd *sys.FD, mi *MapInfo) error {
-	return scanFdInfo(fd, map[string]interface{}{
-		"map_type":    &mi.Type,
+	var mapType uint32
+	err := scanFdInfo(fd, map[string]interface{}{
+		"map_type":    &mapType,
 		"map_id":      &mi.id,
 		"key_size":    &mi.KeySize,
 		"value_size":  &mi.ValueSize,
@@ -116,6 +123,18 @@ func readMapInfoFromProc(fd *sys.FD, mi *MapInfo) error {
 		"memlock":     &mi.memlock,
 		"frozen":      &mi.frozen,
 	})
+	if err != nil {
+		return err
+	}
+
+	if mi.Type == 0 {
+		mi.Type, err = MapTypeForPlatform(platform.Linux, mapType)
+		if err != nil {
+			return fmt.Errorf("map type: %w", err)
+		}
+	}
+
+	return nil
 }
 
 // ID returns the map ID.
@@ -251,8 +270,13 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 		return nil, err
 	}
 
+	typ, err := ProgramTypeForPlatform(platform.Native, info.Type)
+	if err != nil {
+		return nil, fmt.Errorf("program type: %w", err)
+	}
+
 	pi := ProgramInfo{
-		Type: ProgramType(info.Type),
+		Type: typ,
 		id:   ProgramID(info.Id),
 		Tag:  hex.EncodeToString(info.Tag[:]),
 		Name: unix.ByteSliceToString(info.Name[:]),
@@ -267,6 +291,11 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 		verifiedInstructions: info.VerifiedInsns,
 	}
 
+	if platform.IsWindows && info.Tag == [8]uint8{} {
+		// Windows doesn't support the tag field, clear it for now.
+		pi.Tag = ""
+	}
+
 	// Start with a clean struct for the second call, otherwise we may get EFAULT.
 	var info2 sys.ProgInfo
 
@@ -275,7 +304,7 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 	if info.NrMapIds > 0 {
 		pi.maps = make([]MapID, info.NrMapIds)
 		info2.NrMapIds = info.NrMapIds
-		info2.MapIds = sys.NewSlicePointer(pi.maps)
+		info2.MapIds = sys.SlicePointer(pi.maps)
 		makeSecondCall = true
 	} else if haveProgramInfoMapIDs() == nil {
 		// This program really has no associated maps.
@@ -286,7 +315,7 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 	}
 
 	// createdByUID and NrMapIds were introduced in the same kernel version.
-	if pi.maps != nil {
+	if pi.maps != nil && platform.IsLinux {
 		pi.createdByUID = info.CreatedByUid
 		pi.haveCreatedByUID = true
 	}
@@ -294,13 +323,13 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 	if info.XlatedProgLen > 0 {
 		pi.insns = make([]byte, info.XlatedProgLen)
 		info2.XlatedProgLen = info.XlatedProgLen
-		info2.XlatedProgInsns = sys.NewSlicePointer(pi.insns)
+		info2.XlatedProgInsns = sys.SlicePointer(pi.insns)
 		makeSecondCall = true
 	}
 
 	if info.NrLineInfo > 0 {
 		pi.lineInfos = make([]byte, btf.LineInfoSize*info.NrLineInfo)
-		info2.LineInfo = sys.NewSlicePointer(pi.lineInfos)
+		info2.LineInfo = sys.SlicePointer(pi.lineInfos)
 		info2.LineInfoRecSize = btf.LineInfoSize
 		info2.NrLineInfo = info.NrLineInfo
 		pi.numLineInfos = info.NrLineInfo
@@ -309,7 +338,7 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 
 	if info.NrFuncInfo > 0 {
 		pi.funcInfos = make([]byte, btf.FuncInfoSize*info.NrFuncInfo)
-		info2.FuncInfo = sys.NewSlicePointer(pi.funcInfos)
+		info2.FuncInfo = sys.SlicePointer(pi.funcInfos)
 		info2.FuncInfoRecSize = btf.FuncInfoSize
 		info2.NrFuncInfo = info.NrFuncInfo
 		pi.numFuncInfos = info.NrFuncInfo
@@ -321,7 +350,7 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 		pi.jitedInfo.numInsns = info.JitedProgLen
 		pi.jitedInfo.insns = make([]byte, info.JitedProgLen)
 		info2.JitedProgLen = info.JitedProgLen
-		info2.JitedProgInsns = sys.NewSlicePointer(pi.jitedInfo.insns)
+		info2.JitedProgInsns = sys.SlicePointer(pi.jitedInfo.insns)
 		makeSecondCall = true
 	}
 
@@ -329,7 +358,7 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 		pi.jitedInfo.numFuncLens = info.NrJitedFuncLens
 		pi.jitedInfo.funcLens = make([]uint32, info.NrJitedFuncLens)
 		info2.NrJitedFuncLens = info.NrJitedFuncLens
-		info2.JitedFuncLens = sys.NewSlicePointer(pi.jitedInfo.funcLens)
+		info2.JitedFuncLens = sys.SlicePointer(pi.jitedInfo.funcLens)
 		makeSecondCall = true
 	}
 
@@ -337,7 +366,7 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 		pi.jitedInfo.numLineInfos = info.NrJitedLineInfo
 		pi.jitedInfo.lineInfos = make([]uint64, info.NrJitedLineInfo)
 		info2.NrJitedLineInfo = info.NrJitedLineInfo
-		info2.JitedLineInfo = sys.NewSlicePointer(pi.jitedInfo.lineInfos)
+		info2.JitedLineInfo = sys.SlicePointer(pi.jitedInfo.lineInfos)
 		info2.JitedLineInfoRecSize = info.JitedLineInfoRecSize
 		makeSecondCall = true
 	}
@@ -345,7 +374,7 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 	if info.NrJitedKsyms > 0 {
 		pi.jitedInfo.numKsyms = info.NrJitedKsyms
 		pi.jitedInfo.ksyms = make([]uint64, info.NrJitedKsyms)
-		info2.JitedKsyms = sys.NewSlicePointer(pi.jitedInfo.ksyms)
+		info2.JitedKsyms = sys.SlicePointer(pi.jitedInfo.ksyms)
 		info2.NrJitedKsyms = info.NrJitedKsyms
 		makeSecondCall = true
 	}
@@ -361,11 +390,12 @@ func newProgramInfoFromFd(fd *sys.FD) (*ProgramInfo, error) {
 
 func newProgramInfoFromProc(fd *sys.FD) (*ProgramInfo, error) {
 	var info ProgramInfo
+	var progType uint32
 	err := scanFdInfo(fd, map[string]interface{}{
-		"prog_type": &info.Type,
+		"prog_type": &progType,
 		"prog_tag":  &info.Tag,
 	})
-	if errors.Is(err, ErrNotSupported) {
+	if errors.Is(err, ErrNotSupported) && !errors.Is(err, internal.ErrNotSupportedOnOS) {
 		return nil, &internal.UnsupportedFeatureError{
 			Name:           "reading program info from /proc/self/fdinfo",
 			MinimumVersion: internal.Version{4, 10, 0},
@@ -375,6 +405,11 @@ func newProgramInfoFromProc(fd *sys.FD) (*ProgramInfo, error) {
 		return nil, err
 	}
 
+	info.Type, err = ProgramTypeForPlatform(platform.Linux, progType)
+	if err != nil {
+		return nil, fmt.Errorf("program type: %w", err)
+	}
+
 	return &info, nil
 }
 
@@ -507,6 +542,10 @@ func (pi *ProgramInfo) LineInfos() (btf.LineOffsets, error) {
 // Available from 4.13. Requires CAP_BPF or equivalent for plain instructions.
 // Requires CAP_SYS_ADMIN for instructions with metadata.
 func (pi *ProgramInfo) Instructions() (asm.Instructions, error) {
+	if platform.IsWindows && len(pi.insns) == 0 {
+		return nil, fmt.Errorf("read instructions: %w", internal.ErrNotSupportedOnOS)
+	}
+
 	// If the calling process is not BPF-capable or if the kernel doesn't
 	// support getting xlated instructions, the field will be zero.
 	if len(pi.insns) == 0 {
@@ -514,8 +553,8 @@ func (pi *ProgramInfo) Instructions() (asm.Instructions, error) {
 	}
 
 	r := bytes.NewReader(pi.insns)
-	var insns asm.Instructions
-	if err := insns.Unmarshal(r, internal.NativeEndian); err != nil {
+	insns, err := asm.AppendInstructions(nil, r, internal.NativeEndian, platform.Native)
+	if err != nil {
 		return nil, fmt.Errorf("unmarshaling instructions: %w", err)
 	}
 
@@ -705,6 +744,10 @@ func (pi *ProgramInfo) FuncInfos() (btf.FuncOffsets, error) {
 }
 
 func scanFdInfo(fd *sys.FD, fields map[string]interface{}) error {
+	if platform.IsWindows {
+		return fmt.Errorf("read fdinfo: %w", internal.ErrNotSupportedOnOS)
+	}
+
 	fh, err := os.Open(fmt.Sprintf("/proc/self/fdinfo/%d", fd.Int()))
 	if err != nil {
 		return err
@@ -785,6 +828,11 @@ func EnableStats(which uint32) (io.Closer, error) {
 }
 
 var haveProgramInfoMapIDs = internal.NewFeatureTest("map IDs in program info", func() error {
+	if platform.IsWindows {
+		// We only support efW versions which have this feature, no need to probe.
+		return nil
+	}
+
 	prog, err := progLoad(asm.Instructions{
 		asm.LoadImm(asm.R0, 0, asm.DWord),
 		asm.Return(),
@@ -809,4 +857,4 @@ var haveProgramInfoMapIDs = internal.NewFeatureTest("map IDs in program info", f
 	}
 
 	return err
-}, "4.15")
+}, "4.15", "windows:0.20.0")
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/enums.go b/vendor/github.com/cilium/ebpf/internal/efw/enums.go
new file mode 100644
index 0000000000000000000000000000000000000000..71320b6311e2245aa17cfc2c72241fd0fb32664c
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/enums.go
@@ -0,0 +1,65 @@
+//go:build windows
+
+package efw
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+/*
+Converts an attach type enum into a GUID.
+
+	ebpf_result_t ebpf_get_ebpf_attach_type(
+		bpf_attach_type_t bpf_attach_type,
+		_Out_ ebpf_attach_type_t* ebpf_attach_type_t *ebpf_attach_type)
+*/
+var ebpfGetEbpfAttachTypeProc = newProc("ebpf_get_ebpf_attach_type")
+
+func EbpfGetEbpfAttachType(attachType uint32) (windows.GUID, error) {
+	addr, err := ebpfGetEbpfAttachTypeProc.Find()
+	if err != nil {
+		return windows.GUID{}, err
+	}
+
+	var attachTypeGUID windows.GUID
+	err = errorResult(syscall.SyscallN(addr,
+		uintptr(attachType),
+		uintptr(unsafe.Pointer(&attachTypeGUID)),
+	))
+	return attachTypeGUID, err
+}
+
+/*
+Retrieve a program type given a GUID.
+
+	bpf_prog_type_t ebpf_get_bpf_program_type(_In_ const ebpf_program_type_t* program_type)
+*/
+var ebpfGetBpfProgramTypeProc = newProc("ebpf_get_bpf_program_type")
+
+func EbpfGetBpfProgramType(programType windows.GUID) (uint32, error) {
+	addr, err := ebpfGetBpfProgramTypeProc.Find()
+	if err != nil {
+		return 0, err
+	}
+
+	return uint32Result(syscall.SyscallN(addr, uintptr(unsafe.Pointer(&programType)))), nil
+}
+
+/*
+Retrieve an attach type given a GUID.
+
+	bpf_attach_type_t ebpf_get_bpf_attach_type(_In_ const ebpf_attach_type_t* ebpf_attach_type)
+*/
+var ebpfGetBpfAttachTypeProc = newProc("ebpf_get_bpf_attach_type")
+
+func EbpfGetBpfAttachType(attachType windows.GUID) (uint32, error) {
+	addr, err := ebpfGetBpfAttachTypeProc.Find()
+	if err != nil {
+		return 0, err
+	}
+
+	return uint32Result(syscall.SyscallN(addr, uintptr(unsafe.Pointer(&attachType)))), nil
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/error_reporting.go b/vendor/github.com/cilium/ebpf/internal/efw/error_reporting.go
new file mode 100644
index 0000000000000000000000000000000000000000..83b9a265ee26c929c762b202a1e86c0d89f4bf59
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/error_reporting.go
@@ -0,0 +1,155 @@
+//go:build windows
+
+package efw
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"syscall"
+	"testing"
+
+	"golang.org/x/sys/windows"
+)
+
+func init() {
+	if !testing.Testing() {
+		return
+	}
+
+	if isDebuggerPresent() {
+		return
+	}
+
+	if err := configureCRTErrorReporting(); err != nil {
+		fmt.Fprintln(os.Stderr, "WARNING: Could not configure CRT error reporting, tests may hang:", err)
+	}
+}
+
+var errErrorReportingAlreadyConfigured = errors.New("error reporting already configured")
+
+// Configure built-in error reporting of the C runtime library.
+//
+// The C runtime emits assertion failures into a graphical message box by default.
+// This causes a hang in CI environments. This function configures the CRT to
+// log to stderr instead.
+func configureCRTErrorReporting() error {
+	const ucrtDebug = "ucrtbased.dll"
+
+	// Constants from crtdbg.h
+	//
+	// See https://doxygen.reactos.org/da/d40/crt_2crtdbg_8h_source.html
+	const (
+		_CRT_ERROR          = 1
+		_CRT_ASSERT         = 2
+		_CRTDBG_MODE_FILE   = 0x1
+		_CRTDBG_MODE_WNDW   = 0x4
+		_CRTDBG_HFILE_ERROR = -2
+		_CRTDBG_FILE_STDERR = -4
+	)
+
+	// Load the efW API to trigger loading the CRT. This may fail, in which case
+	// we can't figure out which CRT is being used.
+	// In that case we rely on the error bubbling up via some other path.
+	_ = module.Load()
+
+	ucrtHandle, err := syscall.UTF16PtrFromString(ucrtDebug)
+	if err != nil {
+		return err
+	}
+
+	var handle windows.Handle
+	err = windows.GetModuleHandleEx(0, ucrtHandle, &handle)
+	if errors.Is(err, windows.ERROR_MOD_NOT_FOUND) {
+		// Loading the ebpf api did not pull in the debug UCRT, so there is
+		// nothing to configure.
+		return nil
+	} else if err != nil {
+		return err
+	}
+	defer windows.FreeLibrary(handle)
+
+	setReportModeAddr, err := windows.GetProcAddress(handle, "_CrtSetReportMode")
+	if err != nil {
+		return err
+	}
+
+	setReportMode := func(reportType int, reportMode int) (int, error) {
+		// See https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/crtsetreportmode?view=msvc-170
+		r1, _, err := syscall.SyscallN(setReportModeAddr, uintptr(reportType), uintptr(reportMode))
+		if int(r1) == -1 {
+			return 0, fmt.Errorf("set report mode for type %d: %w", reportType, err)
+		}
+		return int(r1), nil
+	}
+
+	setReportFileAddr, err := windows.GetProcAddress(handle, "_CrtSetReportFile")
+	if err != nil {
+		return err
+	}
+
+	setReportFile := func(reportType int, reportFile int) (int, error) {
+		// See https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/crtsetreportfile?view=msvc-170
+		r1, _, err := syscall.SyscallN(setReportFileAddr, uintptr(reportType), uintptr(reportFile))
+		if int(r1) == _CRTDBG_HFILE_ERROR {
+			return 0, fmt.Errorf("set report file for type %d: %w", reportType, err)
+		}
+		return int(r1), nil
+	}
+
+	reportToFile := func(reportType, defaultMode int) error {
+		oldMode, err := setReportMode(reportType, _CRTDBG_MODE_FILE)
+		if err != nil {
+			return err
+		}
+
+		if oldMode != defaultMode {
+			// Attempt to restore old mode if it was different from the expected default.
+			_, _ = setReportMode(reportType, oldMode)
+			return errErrorReportingAlreadyConfigured
+		}
+
+		oldFile, err := setReportFile(reportType, _CRTDBG_FILE_STDERR)
+		if err != nil {
+			return err
+		}
+
+		if oldFile != -1 {
+			// Attempt to restore old file if it was different from the expected default.
+			_, _ = setReportFile(reportType, oldFile)
+			return errErrorReportingAlreadyConfigured
+		}
+
+		return nil
+	}
+
+	// See https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/crtsetreportmode?view=msvc-170#remarks
+	// for defaults.
+	if err := reportToFile(_CRT_ASSERT, _CRTDBG_MODE_WNDW); err != nil {
+		return err
+	}
+
+	if err := reportToFile(_CRT_ERROR, _CRTDBG_MODE_WNDW); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// isDebuggerPresent returns true if the current process is being debugged.
+//
+// See https://learn.microsoft.com/en-us/windows/win32/api/debugapi/nf-debugapi-isdebuggerpresent
+func isDebuggerPresent() bool {
+	kernel32Handle, err := windows.LoadLibrary("kernel32.dll")
+	if err != nil {
+		return false
+	}
+
+	isDebuggerPresentAddr, err := windows.GetProcAddress(kernel32Handle, "IsDebuggerPresent")
+	if err != nil {
+		return false
+	}
+
+	r1, _, _ := syscall.SyscallN(isDebuggerPresentAddr)
+	return r1 != 0
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/fd.go b/vendor/github.com/cilium/ebpf/internal/efw/fd.go
new file mode 100644
index 0000000000000000000000000000000000000000..b0d0bcdd4f449e3079e890925813a2488bd8e55a
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/fd.go
@@ -0,0 +1,34 @@
+//go:build windows
+
+package efw
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// ebpf_result_t ebpf_close_fd(fd_t fd)
+var ebpfCloseFdProc = newProc("ebpf_close_fd")
+
+func EbpfCloseFd(fd int) error {
+	addr, err := ebpfCloseFdProc.Find()
+	if err != nil {
+		return err
+	}
+
+	return errorResult(syscall.SyscallN(addr, uintptr(fd)))
+}
+
+// ebpf_result_t ebpf_duplicate_fd(fd_t fd, _Out_ fd_t* dup)
+var ebpfDuplicateFdProc = newProc("ebpf_duplicate_fd")
+
+func EbpfDuplicateFd(fd int) (int, error) {
+	addr, err := ebpfDuplicateFdProc.Find()
+	if err != nil {
+		return -1, err
+	}
+
+	var dup FD
+	err = errorResult(syscall.SyscallN(addr, uintptr(fd), uintptr(unsafe.Pointer(&dup))))
+	return int(dup), err
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/module.go b/vendor/github.com/cilium/ebpf/internal/efw/module.go
new file mode 100644
index 0000000000000000000000000000000000000000..606d83930a98d700d1338943d53416382c1841c8
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/module.go
@@ -0,0 +1,36 @@
+//go:build windows
+
+// Package efw contains support code for eBPF for Windows.
+package efw
+
+import (
+	"golang.org/x/sys/windows"
+)
+
+// module is the global handle for the eBPF for Windows user-space API.
+var module = windows.NewLazyDLL("ebpfapi.dll")
+
+// FD is the equivalent of fd_t.
+//
+// See https://github.com/microsoft/ebpf-for-windows/blob/54632eb360c560ebef2f173be1a4a4625d540744/include/ebpf_api.h#L24
+type FD int32
+
+// Size is the equivalent of size_t.
+//
+// This is correct on amd64 and arm64 according to tests on godbolt.org.
+type Size uint64
+
+// Int is the equivalent of int on MSVC (am64, arm64) and MinGW (gcc, clang).
+type Int int32
+
+// ObjectType is the equivalent of ebpf_object_type_t.
+//
+// See https://github.com/microsoft/ebpf-for-windows/blob/44f5de09ec0f3f7ad176c00a290c1cb7106cdd5e/include/ebpf_core_structs.h#L41
+type ObjectType uint32
+
+const (
+	EBPF_OBJECT_UNKNOWN ObjectType = iota
+	EBPF_OBJECT_MAP
+	EBPF_OBJECT_LINK
+	EBPF_OBJECT_PROGRAM
+)
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/native.go b/vendor/github.com/cilium/ebpf/internal/efw/native.go
new file mode 100644
index 0000000000000000000000000000000000000000..04f796abbfefb34065ccbf88ca0f7fe85a4add43
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/native.go
@@ -0,0 +1,44 @@
+//go:build windows
+
+package efw
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+/*
+ebpf_result_t ebpf_object_load_native_by_fds(
+
+	_In_z_ const char* file_name,
+	_Inout_ size_t* count_of_maps,
+	_Out_writes_opt_(count_of_maps) fd_t* map_fds,
+	_Inout_ size_t* count_of_programs,
+	_Out_writes_opt_(count_of_programs) fd_t* program_fds)
+*/
+var ebpfObjectLoadNativeByFdsProc = newProc("ebpf_object_load_native_by_fds")
+
+func EbpfObjectLoadNativeFds(fileName string, mapFds []FD, programFds []FD) (int, int, error) {
+	addr, err := ebpfObjectLoadNativeByFdsProc.Find()
+	if err != nil {
+		return 0, 0, err
+	}
+
+	fileBytes, err := windows.ByteSliceFromString(fileName)
+	if err != nil {
+		return 0, 0, err
+	}
+
+	countOfMaps := Size(len(mapFds))
+	countOfPrograms := Size(len(programFds))
+	err = errorResult(syscall.SyscallN(addr,
+		uintptr(unsafe.Pointer(&fileBytes[0])),
+		uintptr(unsafe.Pointer(&countOfMaps)),
+		uintptr(unsafe.Pointer(&mapFds[0])),
+		uintptr(unsafe.Pointer(&countOfPrograms)),
+		uintptr(unsafe.Pointer(&programFds[0])),
+	))
+	return int(countOfMaps), int(countOfPrograms), err
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/object.go b/vendor/github.com/cilium/ebpf/internal/efw/object.go
new file mode 100644
index 0000000000000000000000000000000000000000..732d09754fa6522c2f285c0267ae3bb9b6ae7f68
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/object.go
@@ -0,0 +1,89 @@
+//go:build windows
+
+package efw
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// https://github.com/microsoft/ebpf-for-windows/blob/9d9003c39c3fd75be5225ac0fce30077d6bf0604/include/ebpf_core_structs.h#L15
+const _EBPF_MAX_PIN_PATH_LENGTH = 256
+
+/*
+Retrieve object info and type from a fd.
+
+	ebpf_result_t ebpf_object_get_info_by_fd(
+		fd_t bpf_fd,
+		_Inout_updates_bytes_to_opt_(*info_size, *info_size) void* info,
+		_Inout_opt_ uint32_t* info_size,
+		_Out_opt_ ebpf_object_type_t* type)
+*/
+var ebpfObjectGetInfoByFdProc = newProc("ebpf_object_get_info_by_fd")
+
+func EbpfObjectGetInfoByFd(fd int, info unsafe.Pointer, info_size *uint32) (ObjectType, error) {
+	addr, err := ebpfObjectGetInfoByFdProc.Find()
+	if err != nil {
+		return 0, err
+	}
+
+	var objectType ObjectType
+	err = errorResult(syscall.SyscallN(addr,
+		uintptr(fd),
+		uintptr(info),
+		uintptr(unsafe.Pointer(info_size)),
+		uintptr(unsafe.Pointer(&objectType)),
+	))
+	return objectType, err
+}
+
+// ebpf_result_t ebpf_object_unpin(_In_z_ const char* path)
+var ebpfObjectUnpinProc = newProc("ebpf_object_unpin")
+
+func EbpfObjectUnpin(path string) error {
+	addr, err := ebpfObjectUnpinProc.Find()
+	if err != nil {
+		return err
+	}
+
+	pathBytes, err := windows.ByteSliceFromString(path)
+	if err != nil {
+		return err
+	}
+
+	return errorResult(syscall.SyscallN(addr, uintptr(unsafe.Pointer(&pathBytes[0]))))
+}
+
+/*
+Retrieve the next pinned object path.
+
+	ebpf_result_t ebpf_get_next_pinned_object_path(
+		_In_opt_z_ const char* start_path,
+		_Out_writes_z_(next_path_len) char* next_path,
+		size_t next_path_len,
+		_Inout_opt_ ebpf_object_type_t* type)
+*/
+var ebpfGetNextPinnedObjectPath = newProc("ebpf_get_next_pinned_object_path")
+
+func EbpfGetNextPinnedObjectPath(startPath string, objectType ObjectType) (string, ObjectType, error) {
+	addr, err := ebpfGetNextPinnedObjectPath.Find()
+	if err != nil {
+		return "", 0, err
+	}
+
+	ptr, err := windows.BytePtrFromString(startPath)
+	if err != nil {
+		return "", 0, err
+	}
+
+	tmp := make([]byte, _EBPF_MAX_PIN_PATH_LENGTH)
+	err = errorResult(syscall.SyscallN(addr,
+		uintptr(unsafe.Pointer(ptr)),
+		uintptr(unsafe.Pointer(&tmp[0])),
+		uintptr(len(tmp)),
+		uintptr(unsafe.Pointer(&objectType)),
+	))
+	return windows.ByteSliceToString(tmp), objectType, err
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/proc.go b/vendor/github.com/cilium/ebpf/internal/efw/proc.go
new file mode 100644
index 0000000000000000000000000000000000000000..81329905fd85d9e1cdfb6da69e76a6d78e5b0e67
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/proc.go
@@ -0,0 +1,50 @@
+//go:build windows
+
+package efw
+
+import (
+	"errors"
+	"fmt"
+	"syscall"
+
+	"golang.org/x/sys/windows"
+)
+
+/*
+The BPF syscall wrapper which is ABI compatible with Linux.
+
+	int bpf(int cmd, union bpf_attr* attr, unsigned int size)
+*/
+var BPF = newProc("bpf")
+
+type proc struct {
+	proc *windows.LazyProc
+}
+
+func newProc(name string) proc {
+	return proc{module.NewProc(name)}
+}
+
+func (p proc) Find() (uintptr, error) {
+	if err := p.proc.Find(); err != nil {
+		if errors.Is(err, windows.ERROR_MOD_NOT_FOUND) {
+			return 0, fmt.Errorf("load %s: not found", module.Name)
+		}
+		return 0, err
+	}
+	return p.proc.Addr(), nil
+}
+
+// uint32Result wraps a function which returns a uint32_t.
+func uint32Result(r1, _ uintptr, _ syscall.Errno) uint32 {
+	return uint32(r1)
+}
+
+// errorResult wraps a function which returns ebpf_result_t.
+func errorResult(r1, _ uintptr, errNo syscall.Errno) error {
+	err := resultToError(Result(r1))
+	if err != nil && errNo != 0 {
+		return fmt.Errorf("%w (errno: %v)", err, errNo)
+	}
+	return err
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/program.go b/vendor/github.com/cilium/ebpf/internal/efw/program.go
new file mode 100644
index 0000000000000000000000000000000000000000..6202acf32c32b09d412d53d1899f5ab1c8165f67
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/program.go
@@ -0,0 +1,39 @@
+//go:build windows
+
+package efw
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+/*
+Attach a program.
+
+	ebpf_result_t ebpf_program_attach_by_fds(
+		fd_t program_fd,
+		_In_opt_ const ebpf_attach_type_t* attach_type,
+		_In_reads_bytes_opt_(attach_parameters_size) void* attach_parameters,
+		size_t attach_parameters_size,
+		_Out_ fd_t* link)
+*/
+var ebpfProgramAttachByFdsProc = newProc("ebpf_program_attach_by_fds")
+
+func EbpfProgramAttachFds(fd int, attachType windows.GUID, params unsafe.Pointer, params_size uintptr) (int, error) {
+	addr, err := ebpfProgramAttachByFdsProc.Find()
+	if err != nil {
+		return 0, err
+	}
+
+	var link FD
+	err = errorResult(syscall.SyscallN(addr,
+		uintptr(fd),
+		uintptr(unsafe.Pointer(&attachType)),
+		uintptr(params),
+		params_size,
+		uintptr(unsafe.Pointer(&link)),
+	))
+	return int(link), err
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/result.go b/vendor/github.com/cilium/ebpf/internal/efw/result.go
new file mode 100644
index 0000000000000000000000000000000000000000..3275941d3e6f4279c0e503fb3c186bb853b9deb1
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/result.go
@@ -0,0 +1,57 @@
+//go:build windows
+
+package efw
+
+// See https://github.com/microsoft/ebpf-for-windows/blob/main/include/ebpf_result.h
+type Result int32
+
+//go:generate go run golang.org/x/tools/cmd/stringer@latest -tags windows -output result_string_windows.go -type=Result
+
+const (
+	EBPF_SUCCESS Result = iota
+	EBPF_VERIFICATION_FAILED
+	EBPF_JIT_COMPILATION_FAILED
+	EBPF_PROGRAM_LOAD_FAILED
+	EBPF_INVALID_FD
+	EBPF_INVALID_OBJECT
+	EBPF_INVALID_ARGUMENT
+	EBPF_OBJECT_NOT_FOUND
+	EBPF_OBJECT_ALREADY_EXISTS
+	EBPF_FILE_NOT_FOUND
+	EBPF_ALREADY_PINNED
+	EBPF_NOT_PINNED
+	EBPF_NO_MEMORY
+	EBPF_PROGRAM_TOO_LARGE
+	EBPF_RPC_EXCEPTION
+	EBPF_ALREADY_INITIALIZED
+	EBPF_ELF_PARSING_FAILED
+	EBPF_FAILED
+	EBPF_OPERATION_NOT_SUPPORTED
+	EBPF_KEY_NOT_FOUND
+	EBPF_ACCESS_DENIED
+	EBPF_BLOCKED_BY_POLICY
+	EBPF_ARITHMETIC_OVERFLOW
+	EBPF_EXTENSION_FAILED_TO_LOAD
+	EBPF_INSUFFICIENT_BUFFER
+	EBPF_NO_MORE_KEYS
+	EBPF_KEY_ALREADY_EXISTS
+	EBPF_NO_MORE_TAIL_CALLS
+	EBPF_PENDING
+	EBPF_OUT_OF_SPACE
+	EBPF_CANCELED
+	EBPF_INVALID_POINTER
+	EBPF_TIMEOUT
+	EBPF_STALE_ID
+	EBPF_INVALID_STATE
+)
+
+func (r Result) Error() string {
+	return r.String()
+}
+
+func resultToError(res Result) error {
+	if res == EBPF_SUCCESS {
+		return nil
+	}
+	return res
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/result_string_windows.go b/vendor/github.com/cilium/ebpf/internal/efw/result_string_windows.go
new file mode 100644
index 0000000000000000000000000000000000000000..1e55b51865310d5e43546deded9d3bd3a7a52682
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/result_string_windows.go
@@ -0,0 +1,57 @@
+// Code generated by "stringer -tags windows -output result_string_windows.go -type=Result"; DO NOT EDIT.
+
+package efw
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[EBPF_SUCCESS-0]
+	_ = x[EBPF_VERIFICATION_FAILED-1]
+	_ = x[EBPF_JIT_COMPILATION_FAILED-2]
+	_ = x[EBPF_PROGRAM_LOAD_FAILED-3]
+	_ = x[EBPF_INVALID_FD-4]
+	_ = x[EBPF_INVALID_OBJECT-5]
+	_ = x[EBPF_INVALID_ARGUMENT-6]
+	_ = x[EBPF_OBJECT_NOT_FOUND-7]
+	_ = x[EBPF_OBJECT_ALREADY_EXISTS-8]
+	_ = x[EBPF_FILE_NOT_FOUND-9]
+	_ = x[EBPF_ALREADY_PINNED-10]
+	_ = x[EBPF_NOT_PINNED-11]
+	_ = x[EBPF_NO_MEMORY-12]
+	_ = x[EBPF_PROGRAM_TOO_LARGE-13]
+	_ = x[EBPF_RPC_EXCEPTION-14]
+	_ = x[EBPF_ALREADY_INITIALIZED-15]
+	_ = x[EBPF_ELF_PARSING_FAILED-16]
+	_ = x[EBPF_FAILED-17]
+	_ = x[EBPF_OPERATION_NOT_SUPPORTED-18]
+	_ = x[EBPF_KEY_NOT_FOUND-19]
+	_ = x[EBPF_ACCESS_DENIED-20]
+	_ = x[EBPF_BLOCKED_BY_POLICY-21]
+	_ = x[EBPF_ARITHMETIC_OVERFLOW-22]
+	_ = x[EBPF_EXTENSION_FAILED_TO_LOAD-23]
+	_ = x[EBPF_INSUFFICIENT_BUFFER-24]
+	_ = x[EBPF_NO_MORE_KEYS-25]
+	_ = x[EBPF_KEY_ALREADY_EXISTS-26]
+	_ = x[EBPF_NO_MORE_TAIL_CALLS-27]
+	_ = x[EBPF_PENDING-28]
+	_ = x[EBPF_OUT_OF_SPACE-29]
+	_ = x[EBPF_CANCELED-30]
+	_ = x[EBPF_INVALID_POINTER-31]
+	_ = x[EBPF_TIMEOUT-32]
+	_ = x[EBPF_STALE_ID-33]
+	_ = x[EBPF_INVALID_STATE-34]
+}
+
+const _Result_name = "EBPF_SUCCESSEBPF_VERIFICATION_FAILEDEBPF_JIT_COMPILATION_FAILEDEBPF_PROGRAM_LOAD_FAILEDEBPF_INVALID_FDEBPF_INVALID_OBJECTEBPF_INVALID_ARGUMENTEBPF_OBJECT_NOT_FOUNDEBPF_OBJECT_ALREADY_EXISTSEBPF_FILE_NOT_FOUNDEBPF_ALREADY_PINNEDEBPF_NOT_PINNEDEBPF_NO_MEMORYEBPF_PROGRAM_TOO_LARGEEBPF_RPC_EXCEPTIONEBPF_ALREADY_INITIALIZEDEBPF_ELF_PARSING_FAILEDEBPF_FAILEDEBPF_OPERATION_NOT_SUPPORTEDEBPF_KEY_NOT_FOUNDEBPF_ACCESS_DENIEDEBPF_BLOCKED_BY_POLICYEBPF_ARITHMETIC_OVERFLOWEBPF_EXTENSION_FAILED_TO_LOADEBPF_INSUFFICIENT_BUFFEREBPF_NO_MORE_KEYSEBPF_KEY_ALREADY_EXISTSEBPF_NO_MORE_TAIL_CALLSEBPF_PENDINGEBPF_OUT_OF_SPACEEBPF_CANCELEDEBPF_INVALID_POINTEREBPF_TIMEOUTEBPF_STALE_IDEBPF_INVALID_STATE"
+
+var _Result_index = [...]uint16{0, 12, 36, 63, 87, 102, 121, 142, 163, 189, 208, 227, 242, 256, 278, 296, 320, 343, 354, 382, 400, 418, 440, 464, 493, 517, 534, 557, 580, 592, 609, 622, 642, 654, 667, 685}
+
+func (i Result) String() string {
+	if i < 0 || i >= Result(len(_Result_index)-1) {
+		return "Result(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _Result_name[_Result_index[i]:_Result_index[i+1]]
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/efw/structs.go b/vendor/github.com/cilium/ebpf/internal/efw/structs.go
new file mode 100644
index 0000000000000000000000000000000000000000..558dbb86537f38547ae61e7ac20eecafa46a56c5
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/efw/structs.go
@@ -0,0 +1,36 @@
+//go:build windows
+
+package efw
+
+import "golang.org/x/sys/windows"
+
+// https://github.com/microsoft/ebpf-for-windows/blob/95267a53b26c68a94145d1731e2a4c8b546034c3/include/ebpf_structs.h#L366
+const _BPF_OBJ_NAME_LEN = 64
+
+// See https://github.com/microsoft/ebpf-for-windows/blob/95267a53b26c68a94145d1731e2a4c8b546034c3/include/ebpf_structs.h#L372-L386
+type BpfMapInfo struct {
+	_    uint32                  ///< Map ID.
+	_    uint32                  ///< Type of map.
+	_    uint32                  ///< Size in bytes of a map key.
+	_    uint32                  ///< Size in bytes of a map value.
+	_    uint32                  ///< Maximum number of entries allowed in the map.
+	Name [_BPF_OBJ_NAME_LEN]byte ///< Null-terminated map name.
+	_    uint32                  ///< Map flags.
+
+	_ uint32 ///< ID of inner map template.
+	_ uint32 ///< Number of pinned paths.
+}
+
+// See https://github.com/microsoft/ebpf-for-windows/blob/95267a53b26c68a94145d1731e2a4c8b546034c3/include/ebpf_structs.h#L396-L410
+type BpfProgInfo struct {
+	_    uint32                  ///< Program ID.
+	_    uint32                  ///< Program type, if a cross-platform type.
+	_    uint32                  ///< Number of maps associated with this program.
+	_    uintptr                 ///< Pointer to caller-allocated array to fill map IDs into.
+	Name [_BPF_OBJ_NAME_LEN]byte ///< Null-terminated map name.
+
+	_ windows.GUID ///< Program type UUID.
+	_ windows.GUID ///< Attach type UUID.
+	_ uint32       ///< Number of pinned paths.
+	_ uint32       ///< Number of attached links.
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/feature.go b/vendor/github.com/cilium/ebpf/internal/feature.go
index 6f64822e11d6277ce850d86410f9b14af5708ea7..82b8d93956ae9bbf927283cce69df9df1166c6c3 100644
--- a/vendor/github.com/cilium/ebpf/internal/feature.go
+++ b/vendor/github.com/cilium/ebpf/internal/feature.go
@@ -4,8 +4,9 @@ import (
 	"errors"
 	"fmt"
 	"runtime"
-	"strings"
 	"sync"
+
+	"github.com/cilium/ebpf/internal/platform"
 )
 
 // ErrNotSupported indicates that a feature is not supported.
@@ -74,33 +75,12 @@ type FeatureTestFn func() error
 // Linux. Returns [ErrNotSupportedOnOS] if there is no version specified for the
 // current OS.
 func NewFeatureTest(name string, fn FeatureTestFn, versions ...string) func() error {
-	const nativePrefix = runtime.GOOS + ":"
-
-	if len(versions) == 0 {
-		return func() error {
-			return fmt.Errorf("feature test %q: no versions specified", name)
-		}
-	}
-
-	ft := &FeatureTest{
-		Name: name,
-		Fn:   fn,
-	}
-
-	for _, version := range versions {
-		if strings.HasPrefix(version, nativePrefix) {
-			ft.Version = strings.TrimPrefix(version, nativePrefix)
-			break
-		}
-
-		if OnLinux && !strings.ContainsRune(version, ':') {
-			// Allow version numbers without a GOOS prefix on Linux.
-			ft.Version = version
-			break
-		}
+	version, err := platform.SelectVersion(versions)
+	if err != nil {
+		return func() error { return err }
 	}
 
-	if ft.Version == "" {
+	if version == "" {
 		return func() error {
 			// We don't return an UnsupportedFeatureError here, since that will
 			// trigger version checks which don't make sense.
@@ -108,6 +88,12 @@ func NewFeatureTest(name string, fn FeatureTestFn, versions ...string) func() er
 		}
 	}
 
+	ft := &FeatureTest{
+		Name:    name,
+		Version: version,
+		Fn:      fn,
+	}
+
 	return ft.execute
 }
 
@@ -175,12 +161,18 @@ type FeatureMatrix[K comparable] map[K]*FeatureTest
 // Result returns the outcome of the feature test for the given key.
 //
 // It's safe to call this function concurrently.
+//
+// Always returns [ErrNotSupportedOnOS] on Windows.
 func (fm FeatureMatrix[K]) Result(key K) error {
 	ft, ok := fm[key]
 	if !ok {
 		return fmt.Errorf("no feature probe for %v", key)
 	}
 
+	if platform.IsWindows {
+		return fmt.Errorf("%s: %w", ft.Name, ErrNotSupportedOnOS)
+	}
+
 	return ft.execute()
 }
 
@@ -201,6 +193,10 @@ func NewFeatureCache[K comparable](newTest func(K) *FeatureTest) *FeatureCache[K
 }
 
 func (fc *FeatureCache[K]) Result(key K) error {
+	if platform.IsWindows {
+		return fmt.Errorf("feature probe for %v: %w", key, ErrNotSupportedOnOS)
+	}
+
 	// NB: Executing the feature test happens without fc.mu taken.
 	return fc.retrieve(key).execute()
 }
diff --git a/vendor/github.com/cilium/ebpf/internal/goos.go b/vendor/github.com/cilium/ebpf/internal/goos.go
deleted file mode 100644
index 0569d5ce0bc6a84482f2be74a04892a8fcde6eba..0000000000000000000000000000000000000000
--- a/vendor/github.com/cilium/ebpf/internal/goos.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package internal
-
-import "runtime"
-
-const (
-	OnLinux = runtime.GOOS == "linux"
-)
diff --git a/vendor/github.com/cilium/ebpf/internal/kallsyms/kallsyms.go b/vendor/github.com/cilium/ebpf/internal/kallsyms/kallsyms.go
index 2cdfb56a584d5f7f8914df82e02155ab6a49a673..c7b12c47c884850c04f4703b207ed69290fbc8e9 100644
--- a/vendor/github.com/cilium/ebpf/internal/kallsyms/kallsyms.go
+++ b/vendor/github.com/cilium/ebpf/internal/kallsyms/kallsyms.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/platform"
 )
 
 var errAmbiguousKsym = errors.New("multiple kernel symbols with the same name")
@@ -49,7 +50,7 @@ func Module(name string) (string, error) {
 // Any symbols missing in the kernel are ignored. Returns an error if multiple
 // symbols with a given name were found.
 func AssignModules(symbols map[string]string) error {
-	if !internal.OnLinux {
+	if !platform.IsLinux {
 		return fmt.Errorf("read /proc/kallsyms: %w", internal.ErrNotSupportedOnOS)
 	}
 
@@ -168,7 +169,7 @@ func Address(symbol string) (uint64, error) {
 // Any symbols missing in the kernel are ignored. Returns an error if multiple
 // addresses were found for a symbol.
 func AssignAddresses(symbols map[string]uint64) error {
-	if !internal.OnLinux {
+	if !platform.IsLinux {
 		return fmt.Errorf("read /proc/kallsyms: %w", internal.ErrNotSupportedOnOS)
 	}
 
@@ -281,7 +282,7 @@ func parseSymbol(r *reader, types []rune) (s ksym, err error, skip bool) {
 			s.mod = strings.Trim(r.Text(), "[]")
 		// Ignore any future fields.
 		default:
-			break
+			return
 		}
 	}
 
diff --git a/vendor/github.com/cilium/ebpf/internal/linux/auxv.go b/vendor/github.com/cilium/ebpf/internal/linux/auxv.go
index 10508fd8fcde4eb679511d21b43c91564cc78b54..a864d6b4a9dca4d91a348aa1f5a8c07752afaaa1 100644
--- a/vendor/github.com/cilium/ebpf/internal/linux/auxv.go
+++ b/vendor/github.com/cilium/ebpf/internal/linux/auxv.go
@@ -5,6 +5,7 @@ import (
 	"io"
 
 	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/unix"
 )
 
@@ -46,7 +47,7 @@ func (r *auxvRuntimeReader) ReadAuxvPair() (uint64, uint64, error) {
 }
 
 func newAuxvRuntimeReader() (auxvPairReader, error) {
-	if !internal.OnLinux {
+	if !platform.IsLinux {
 		return nil, fmt.Errorf("read auxv from runtime: %w", internal.ErrNotSupportedOnOS)
 	}
 
diff --git a/vendor/github.com/cilium/ebpf/internal/linux/cpu.go b/vendor/github.com/cilium/ebpf/internal/linux/cpu.go
new file mode 100644
index 0000000000000000000000000000000000000000..bd55ac915e12b442a52c26d6dc435de824cee02e
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/linux/cpu.go
@@ -0,0 +1,45 @@
+package linux
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+func ParseCPUsFromFile(path string) (int, error) {
+	spec, err := os.ReadFile(path)
+	if err != nil {
+		return 0, err
+	}
+
+	n, err := parseCPUs(string(spec))
+	if err != nil {
+		return 0, fmt.Errorf("can't parse %s: %v", path, err)
+	}
+
+	return n, nil
+}
+
+// parseCPUs parses the number of cpus from a string produced
+// by bitmap_list_string() in the Linux kernel.
+// Multiple ranges are rejected, since they can't be unified
+// into a single number.
+// This is the format of /sys/devices/system/cpu/possible, it
+// is not suitable for /sys/devices/system/cpu/online, etc.
+func parseCPUs(spec string) (int, error) {
+	if strings.Trim(spec, "\n") == "0" {
+		return 1, nil
+	}
+
+	var low, high int
+	n, err := fmt.Sscanf(spec, "%d-%d\n", &low, &high)
+	if n != 2 || err != nil {
+		return 0, fmt.Errorf("invalid format: %s", spec)
+	}
+	if low != 0 {
+		return 0, fmt.Errorf("CPU spec doesn't start at zero: %s", spec)
+	}
+
+	// cpus is 0 indexed
+	return high + 1, nil
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/output.go b/vendor/github.com/cilium/ebpf/internal/output.go
index dd6e6cbafe0e9da88bbf302d14de7322fa8a5768..bcbb6818df77a792f48395a570c559635a93b6b2 100644
--- a/vendor/github.com/cilium/ebpf/internal/output.go
+++ b/vendor/github.com/cilium/ebpf/internal/output.go
@@ -92,6 +92,11 @@ func GoTypeName(t any) string {
 	for rT.Kind() == reflect.Pointer {
 		rT = rT.Elem()
 	}
-	// Doesn't return the correct Name for generic types due to https://github.com/golang/go/issues/55924
-	return rT.Name()
+
+	name := rT.Name()
+	if pkgPath := rT.PkgPath(); pkgPath != "" {
+		name = strings.ReplaceAll(name, pkgPath+".", "")
+	}
+
+	return name
 }
diff --git a/vendor/github.com/cilium/ebpf/internal/platform/constants.go b/vendor/github.com/cilium/ebpf/internal/platform/constants.go
new file mode 100644
index 0000000000000000000000000000000000000000..f04af9be746b0cbed04545e03dd0fa9bd673ac74
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/platform/constants.go
@@ -0,0 +1,62 @@
+package platform
+
+import "fmt"
+
+// Values used to tag platform specific constants.
+//
+// The value for Linux is zero so that existing constants do not change.
+const (
+	LinuxTag = uint32(iota) << platformShift
+	WindowsTag
+)
+
+const (
+	platformMax   = 0xf
+	platformShift = 28
+	platformMask  = platformMax << platformShift
+)
+
+func tagForPlatform(platform string) (uint32, error) {
+	switch platform {
+	case Linux:
+		return LinuxTag, nil
+	case Windows:
+		return WindowsTag, nil
+	default:
+		return 0, fmt.Errorf("unrecognized platform: %s", platform)
+	}
+}
+
+func platformForConstant(c uint32) string {
+	tag := uint32(c & platformMask)
+	switch tag {
+	case LinuxTag:
+		return Linux
+	case WindowsTag:
+		return Windows
+	default:
+		return ""
+	}
+}
+
+// Encode a platform and a value into a tagged constant.
+//
+// Returns an error if platform is unknown or c is out of bounds.
+func EncodeConstant[T ~uint32](platform string, c uint32) (T, error) {
+	if c>>platformShift > 0 {
+		return 0, fmt.Errorf("invalid constant 0x%x", c)
+	}
+
+	tag, err := tagForPlatform(platform)
+	if err != nil {
+		return 0, err
+	}
+
+	return T(tag | c), nil
+}
+
+// Decode a platform and a value from a tagged constant.
+func DecodeConstant[T ~uint32](c T) (string, uint32) {
+	v := uint32(c) & ^uint32(platformMask)
+	return platformForConstant(uint32(c)), v
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/platform/platform.go b/vendor/github.com/cilium/ebpf/internal/platform/platform.go
new file mode 100644
index 0000000000000000000000000000000000000000..2c6ecf46a86cb19bca2b86494210c5e6b46d7197
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/platform/platform.go
@@ -0,0 +1,42 @@
+package platform
+
+import (
+	"errors"
+	"runtime"
+	"strings"
+)
+
+const (
+	Linux   = "linux"
+	Windows = "windows"
+)
+
+const (
+	IsLinux   = runtime.GOOS == "linux"
+	IsWindows = runtime.GOOS == "windows"
+)
+
+// SelectVersion extracts the platform-appropriate version from a list of strings like
+// `linux:6.1` or `windows:0.20.0`.
+//
+// Returns an empty string and nil if no version matched or an error if no strings were passed.
+func SelectVersion(versions []string) (string, error) {
+	const prefix = runtime.GOOS + ":"
+
+	if len(versions) == 0 {
+		return "", errors.New("no versions specified")
+	}
+
+	for _, version := range versions {
+		if strings.HasPrefix(version, prefix) {
+			return strings.TrimPrefix(version, prefix), nil
+		}
+
+		if IsLinux && !strings.ContainsRune(version, ':') {
+			// Allow version numbers without a GOOS prefix on Linux.
+			return version, nil
+		}
+	}
+
+	return "", nil
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/platform/platform_linux.go b/vendor/github.com/cilium/ebpf/internal/platform/platform_linux.go
new file mode 100644
index 0000000000000000000000000000000000000000..f0aa240dc2a602ca54d4ca3cb8dd07e69d01bacc
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/platform/platform_linux.go
@@ -0,0 +1,3 @@
+package platform
+
+const Native = Linux
diff --git a/vendor/github.com/cilium/ebpf/internal/platform/platform_other.go b/vendor/github.com/cilium/ebpf/internal/platform/platform_other.go
new file mode 100644
index 0000000000000000000000000000000000000000..cd33b3f6858d5b797d06f687c2ffbd6ac1abc15b
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/platform/platform_other.go
@@ -0,0 +1,5 @@
+//go:build !linux && !windows
+
+package platform
+
+const Native = ""
diff --git a/vendor/github.com/cilium/ebpf/internal/platform/platform_windows.go b/vendor/github.com/cilium/ebpf/internal/platform/platform_windows.go
new file mode 100644
index 0000000000000000000000000000000000000000..26b4a8ecb3a448abfb22802bfdd650a5f5fff7c6
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/platform/platform_windows.go
@@ -0,0 +1,3 @@
+package platform
+
+const Native = Windows
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/fd.go b/vendor/github.com/cilium/ebpf/internal/sys/fd.go
index e2ba43fd3b3e043b1da90b8188bae1d30776bdcb..7e769fb54e858a1e68a5f11f8eec088fb3880f83 100644
--- a/vendor/github.com/cilium/ebpf/internal/sys/fd.go
+++ b/vendor/github.com/cilium/ebpf/internal/sys/fd.go
@@ -1,26 +1,25 @@
 package sys
 
 import (
-	"fmt"
 	"math"
-	"os"
-	"path/filepath"
 	"runtime"
 	"strconv"
-	"strings"
 
-	"github.com/cilium/ebpf/internal/testutils/fdtrace"
+	"github.com/cilium/ebpf/internal/testutils/testmain"
 	"github.com/cilium/ebpf/internal/unix"
 )
 
 var ErrClosedFd = unix.EBADF
 
-type FD struct {
-	raw int
-}
+// A value for an invalid fd.
+//
+// Luckily this is consistent across Linux and Windows.
+//
+// See https://github.com/microsoft/ebpf-for-windows/blob/54632eb360c560ebef2f173be1a4a4625d540744/include/ebpf_api.h#L25
+const invalidFd = -1
 
 func newFD(value int) *FD {
-	fdtrace.TraceFD(value, 1)
+	testmain.TraceFD(value, 1)
 
 	fd := &FD{value}
 	runtime.SetFinalizer(fd, (*FD).finalize)
@@ -30,33 +29,13 @@ func newFD(value int) *FD {
 // finalize is set as the FD's runtime finalizer and
 // sends a leak trace before calling FD.Close().
 func (fd *FD) finalize() {
-	if fd.raw < 0 {
+	if fd.raw == invalidFd {
 		return
 	}
 
-	fdtrace.LeakFD(fd.raw)
-
-	_ = fd.Close()
-}
-
-// NewFD wraps a raw fd with a finalizer.
-//
-// You must not use the raw fd after calling this function, since the underlying
-// file descriptor number may change. This is because the BPF UAPI assumes that
-// zero is not a valid fd value.
-func NewFD(value int) (*FD, error) {
-	if value < 0 {
-		return nil, fmt.Errorf("invalid fd %d", value)
-	}
-
-	fd := newFD(value)
-	if value != 0 {
-		return fd, nil
-	}
+	testmain.LeakFD(fd.raw)
 
-	dup, err := fd.Dup()
 	_ = fd.Close()
-	return dup, err
 }
 
 func (fd *FD) String() string {
@@ -64,11 +43,11 @@ func (fd *FD) String() string {
 }
 
 func (fd *FD) Int() int {
-	return fd.raw
+	return int(fd.raw)
 }
 
 func (fd *FD) Uint() uint32 {
-	if fd.raw < 0 || int64(fd.raw) > math.MaxUint32 {
+	if fd.raw == invalidFd {
 		// Best effort: this is the number most likely to be an invalid file
 		// descriptor. It is equal to -1 (on two's complement arches).
 		return math.MaxUint32
@@ -76,90 +55,14 @@ func (fd *FD) Uint() uint32 {
 	return uint32(fd.raw)
 }
 
-func (fd *FD) Close() error {
-	if fd.raw < 0 {
-		return nil
-	}
-
-	return unix.Close(fd.Disown())
-}
-
 // Disown destroys the FD and returns its raw file descriptor without closing
 // it. After this call, the underlying fd is no longer tied to the FD's
 // lifecycle.
 func (fd *FD) Disown() int {
 	value := fd.raw
-	fdtrace.ForgetFD(value)
-	fd.raw = -1
+	testmain.ForgetFD(value)
+	fd.raw = invalidFd
 
 	runtime.SetFinalizer(fd, nil)
 	return value
 }
-
-func (fd *FD) Dup() (*FD, error) {
-	if fd.raw < 0 {
-		return nil, ErrClosedFd
-	}
-
-	// Always require the fd to be larger than zero: the BPF API treats the value
-	// as "no argument provided".
-	dup, err := unix.FcntlInt(uintptr(fd.raw), unix.F_DUPFD_CLOEXEC, 1)
-	if err != nil {
-		return nil, fmt.Errorf("can't dup fd: %v", err)
-	}
-
-	return newFD(dup), nil
-}
-
-// File takes ownership of FD and turns it into an [*os.File].
-//
-// You must not use the FD after the call returns.
-//
-// Returns nil if the FD is not valid.
-func (fd *FD) File(name string) *os.File {
-	if fd.raw < 0 {
-		return nil
-	}
-
-	return os.NewFile(uintptr(fd.Disown()), name)
-}
-
-// ObjGetTyped wraps [ObjGet] with a readlink call to extract the type of the
-// underlying bpf object.
-func ObjGetTyped(attr *ObjGetAttr) (*FD, ObjType, error) {
-	fd, err := ObjGet(attr)
-	if err != nil {
-		return nil, 0, err
-	}
-
-	typ, err := readType(fd)
-	if err != nil {
-		_ = fd.Close()
-		return nil, 0, fmt.Errorf("reading fd type: %w", err)
-	}
-
-	return fd, typ, nil
-}
-
-// readType returns the bpf object type of the file descriptor by calling
-// readlink(3). Returns an error if the file descriptor does not represent a bpf
-// object.
-func readType(fd *FD) (ObjType, error) {
-	s, err := os.Readlink(filepath.Join("/proc/self/fd/", fd.String()))
-	if err != nil {
-		return 0, fmt.Errorf("readlink fd %d: %w", fd.Int(), err)
-	}
-
-	s = strings.TrimPrefix(s, "anon_inode:")
-
-	switch s {
-	case "bpf-map":
-		return BPF_TYPE_MAP, nil
-	case "bpf-prog":
-		return BPF_TYPE_PROG, nil
-	case "bpf-link":
-		return BPF_TYPE_LINK, nil
-	}
-
-	return 0, fmt.Errorf("unknown type %s of fd %d", s, fd.Int())
-}
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/fd_other.go b/vendor/github.com/cilium/ebpf/internal/sys/fd_other.go
new file mode 100644
index 0000000000000000000000000000000000000000..47057395ec6d17c71be53baa74daba05e9a88696
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/sys/fd_other.go
@@ -0,0 +1,70 @@
+//go:build !windows
+
+package sys
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/cilium/ebpf/internal/unix"
+)
+
+type FD struct {
+	raw int
+}
+
+// NewFD wraps a raw fd with a finalizer.
+//
+// You must not use the raw fd after calling this function, since the underlying
+// file descriptor number may change. This is because the BPF UAPI assumes that
+// zero is not a valid fd value.
+func NewFD(value int) (*FD, error) {
+	if value < 0 {
+		return nil, fmt.Errorf("invalid fd %d", value)
+	}
+
+	fd := newFD(value)
+	if value != 0 {
+		return fd, nil
+	}
+
+	dup, err := fd.Dup()
+	_ = fd.Close()
+	return dup, err
+}
+
+func (fd *FD) Close() error {
+	if fd.raw < 0 {
+		return nil
+	}
+
+	return unix.Close(fd.Disown())
+}
+
+func (fd *FD) Dup() (*FD, error) {
+	if fd.raw < 0 {
+		return nil, ErrClosedFd
+	}
+
+	// Always require the fd to be larger than zero: the BPF API treats the value
+	// as "no argument provided".
+	dup, err := unix.FcntlInt(uintptr(fd.raw), unix.F_DUPFD_CLOEXEC, 1)
+	if err != nil {
+		return nil, fmt.Errorf("can't dup fd: %v", err)
+	}
+
+	return newFD(dup), nil
+}
+
+// File takes ownership of FD and turns it into an [*os.File].
+//
+// You must not use the FD after the call returns.
+//
+// Returns [ErrClosedFd] if the fd is not valid.
+func (fd *FD) File(name string) (*os.File, error) {
+	if fd.raw == invalidFd {
+		return nil, ErrClosedFd
+	}
+
+	return os.NewFile(uintptr(fd.Disown()), name), nil
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/fd_windows.go b/vendor/github.com/cilium/ebpf/internal/sys/fd_windows.go
new file mode 100644
index 0000000000000000000000000000000000000000..f3927638233b594f77c9ccf3f11b374a33c23771
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/sys/fd_windows.go
@@ -0,0 +1,58 @@
+package sys
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/efw"
+)
+
+// FD wraps a handle which is managed by the eBPF for Windows runtime.
+//
+// It is not equivalent to a real file descriptor or handle.
+type FD struct {
+	raw int
+}
+
+// NewFD wraps a raw fd with a finalizer.
+//
+// You must not use the raw fd after calling this function.
+func NewFD(value int) (*FD, error) {
+	if value == invalidFd {
+		return nil, fmt.Errorf("invalid fd %d", value)
+	}
+
+	if value == 0 {
+		// The efW runtime never uses zero fd it seems. No need to dup it.
+		return nil, fmt.Errorf("invalid zero fd")
+	}
+
+	return newFD(value), nil
+}
+
+func (fd *FD) Close() error {
+	if fd.raw == invalidFd {
+		return nil
+	}
+
+	return efw.EbpfCloseFd(fd.Disown())
+}
+
+func (fd *FD) Dup() (*FD, error) {
+	if fd.raw == invalidFd {
+		return nil, ErrClosedFd
+	}
+
+	dup, err := efw.EbpfDuplicateFd(fd.raw)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewFD(int(dup))
+}
+
+// File is not implemented.
+func (fd *FD) File(name string) (*os.File, error) {
+	return nil, fmt.Errorf("file from fd: %w", internal.ErrNotSupportedOnOS)
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/pinning.go b/vendor/github.com/cilium/ebpf/internal/sys/pinning_other.go
similarity index 98%
rename from vendor/github.com/cilium/ebpf/internal/sys/pinning.go
rename to vendor/github.com/cilium/ebpf/internal/sys/pinning_other.go
index 9a4c6c7a15381fd34fbe157a7e2e6d29ce64aa2e..96ad43abd3e20f35b5a4f41ee736bd41ae8177eb 100644
--- a/vendor/github.com/cilium/ebpf/internal/sys/pinning.go
+++ b/vendor/github.com/cilium/ebpf/internal/sys/pinning_other.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package sys
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/pinning_windows.go b/vendor/github.com/cilium/ebpf/internal/sys/pinning_windows.go
new file mode 100644
index 0000000000000000000000000000000000000000..c8ab685500e68342b181bf03961b6aa9b9fa8074
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/sys/pinning_windows.go
@@ -0,0 +1,44 @@
+package sys
+
+import (
+	"errors"
+	"runtime"
+
+	"github.com/cilium/ebpf/internal/efw"
+)
+
+func Pin(currentPath, newPath string, fd *FD) error {
+	defer runtime.KeepAlive(fd)
+
+	if newPath == "" {
+		return errors.New("given pinning path cannot be empty")
+	}
+	if currentPath == newPath {
+		return nil
+	}
+
+	if currentPath == "" {
+		return ObjPin(&ObjPinAttr{
+			Pathname: NewStringPointer(newPath),
+			BpfFd:    fd.Uint(),
+		})
+	}
+
+	return ObjPin(&ObjPinAttr{
+		Pathname: NewStringPointer(newPath),
+		BpfFd:    fd.Uint(),
+	})
+}
+
+func Unpin(pinnedPath string) error {
+	if pinnedPath == "" {
+		return nil
+	}
+
+	err := efw.EbpfObjectUnpin(pinnedPath)
+	if err != nil && !errors.Is(err, efw.EBPF_KEY_NOT_FOUND) {
+		return err
+	}
+
+	return nil
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/ptr.go b/vendor/github.com/cilium/ebpf/internal/sys/ptr.go
index af0c014e3b973d13c6368cdc0a0d64e1174f4092..173665c2a9dcdc3303ee2af0e5f1c2b6fdfd7112 100644
--- a/vendor/github.com/cilium/ebpf/internal/sys/ptr.go
+++ b/vendor/github.com/cilium/ebpf/internal/sys/ptr.go
@@ -6,13 +6,13 @@ import (
 	"github.com/cilium/ebpf/internal/unix"
 )
 
-// NewPointer creates a 64-bit pointer from an unsafe Pointer.
-func NewPointer(ptr unsafe.Pointer) Pointer {
+// UnsafePointer creates a 64-bit pointer from an unsafe Pointer.
+func UnsafePointer(ptr unsafe.Pointer) Pointer {
 	return Pointer{ptr: ptr}
 }
 
-// NewSlicePointer creates a 64-bit pointer from a slice.
-func NewSlicePointer[T comparable](buf []T) Pointer {
+// UnsafeSlicePointer creates an untyped [Pointer] from a slice.
+func UnsafeSlicePointer[T comparable](buf []T) Pointer {
 	if len(buf) == 0 {
 		return Pointer{}
 	}
@@ -20,21 +20,39 @@ func NewSlicePointer[T comparable](buf []T) Pointer {
 	return Pointer{ptr: unsafe.Pointer(unsafe.SliceData(buf))}
 }
 
-// NewSlicePointerLen creates a 64-bit pointer from a byte slice.
+// TypedPointer points to typed memory.
 //
-// Useful to assign both the pointer and the length in one go.
-func NewSlicePointerLen(buf []byte) (Pointer, uint32) {
-	return NewSlicePointer(buf), uint32(len(buf))
+// It is like a *T except that it accounts for the BPF syscall interface.
+type TypedPointer[T any] struct {
+	_   [0]*T // prevent TypedPointer[a] to be convertible to TypedPointer[b]
+	ptr Pointer
 }
 
-// NewStringPointer creates a 64-bit pointer from a string.
-func NewStringPointer(str string) Pointer {
-	p, err := unix.BytePtrFromString(str)
+// SlicePointer creates a [TypedPointer] from a slice.
+func SlicePointer[T comparable](s []T) TypedPointer[T] {
+	return TypedPointer[T]{ptr: UnsafeSlicePointer(s)}
+}
+
+// StringPointer points to a null-terminated string.
+type StringPointer struct {
+	_   [0]string
+	ptr Pointer
+}
+
+// NewStringPointer creates a [StringPointer] from a string.
+func NewStringPointer(str string) StringPointer {
+	slice, err := unix.ByteSliceFromString(str)
 	if err != nil {
-		return Pointer{}
+		return StringPointer{}
 	}
 
-	return Pointer{ptr: unsafe.Pointer(p)}
+	return StringPointer{ptr: Pointer{ptr: unsafe.Pointer(&slice[0])}}
+}
+
+// StringSlicePointer points to a slice of [StringPointer].
+type StringSlicePointer struct {
+	_   [0][]string
+	ptr Pointer
 }
 
 // NewStringSlicePointer allocates an array of Pointers to each string in the
@@ -42,11 +60,11 @@ func NewStringPointer(str string) Pointer {
 // resulting array.
 //
 // Use this function to pass arrays of strings as syscall arguments.
-func NewStringSlicePointer(strings []string) Pointer {
-	sp := make([]Pointer, 0, len(strings))
+func NewStringSlicePointer(strings []string) StringSlicePointer {
+	sp := make([]StringPointer, 0, len(strings))
 	for _, s := range strings {
 		sp = append(sp, NewStringPointer(s))
 	}
 
-	return Pointer{ptr: unsafe.Pointer(&sp[0])}
+	return StringSlicePointer{ptr: Pointer{ptr: unsafe.Pointer(&sp[0])}}
 }
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/ptr_32_be.go b/vendor/github.com/cilium/ebpf/internal/sys/ptr_32_be.go
index 6278c79c9ef1f1f94d59a5bbfe765fa877e8bf7a..0b0feeb7a6f4541f8353ef73a4ccb5178e716370 100644
--- a/vendor/github.com/cilium/ebpf/internal/sys/ptr_32_be.go
+++ b/vendor/github.com/cilium/ebpf/internal/sys/ptr_32_be.go
@@ -3,12 +3,14 @@
 package sys
 
 import (
+	"structs"
 	"unsafe"
 )
 
 // Pointer wraps an unsafe.Pointer to be 64bit to
 // conform to the syscall specification.
 type Pointer struct {
+	structs.HostLayout
 	pad uint32
 	ptr unsafe.Pointer
 }
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/ptr_32_le.go b/vendor/github.com/cilium/ebpf/internal/sys/ptr_32_le.go
index c27b537e8e08bdff4a9240415caf3e5c06665325..f9007fe84bcc1737fcdc439c1583c2af1b8e220e 100644
--- a/vendor/github.com/cilium/ebpf/internal/sys/ptr_32_le.go
+++ b/vendor/github.com/cilium/ebpf/internal/sys/ptr_32_le.go
@@ -3,12 +3,14 @@
 package sys
 
 import (
+	"structs"
 	"unsafe"
 )
 
 // Pointer wraps an unsafe.Pointer to be 64bit to
 // conform to the syscall specification.
 type Pointer struct {
+	structs.HostLayout
 	ptr unsafe.Pointer
 	pad uint32
 }
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/ptr_64.go b/vendor/github.com/cilium/ebpf/internal/sys/ptr_64.go
index 2d7828230ae7203bfaa1b8631c6c3426aa6efbdf..05196cca74447907af6039a6e1e274620ab25634 100644
--- a/vendor/github.com/cilium/ebpf/internal/sys/ptr_64.go
+++ b/vendor/github.com/cilium/ebpf/internal/sys/ptr_64.go
@@ -3,11 +3,13 @@
 package sys
 
 import (
+	"structs"
 	"unsafe"
 )
 
 // Pointer wraps an unsafe.Pointer to be 64bit to
 // conform to the syscall specification.
 type Pointer struct {
+	structs.HostLayout
 	ptr unsafe.Pointer
 }
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/signals.go b/vendor/github.com/cilium/ebpf/internal/sys/signals.go
index e5337191d69d05b0e27fa60b2d78f386b3dfe9bc..e75e96052049ae6ef3b3b787018304361f028677 100644
--- a/vendor/github.com/cilium/ebpf/internal/sys/signals.go
+++ b/vendor/github.com/cilium/ebpf/internal/sys/signals.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package sys
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/syscall.go b/vendor/github.com/cilium/ebpf/internal/sys/syscall.go
index 4fdb74c57ada1440eb947ea95f816bad75eec2fa..f2fffd26b786d32426575dd1e38317647719dab1 100644
--- a/vendor/github.com/cilium/ebpf/internal/sys/syscall.go
+++ b/vendor/github.com/cilium/ebpf/internal/sys/syscall.go
@@ -12,36 +12,6 @@ import (
 // It is not the same as ENOTSUP or EOPNOTSUPP.
 const ENOTSUPP = unix.Errno(524)
 
-// BPF wraps SYS_BPF.
-//
-// Any pointers contained in attr must use the Pointer type from this package.
-func BPF(cmd Cmd, attr unsafe.Pointer, size uintptr) (uintptr, error) {
-	// Prevent the Go profiler from repeatedly interrupting the verifier,
-	// which could otherwise lead to a livelock due to receiving EAGAIN.
-	if cmd == BPF_PROG_LOAD || cmd == BPF_PROG_RUN {
-		maskProfilerSignal()
-		defer unmaskProfilerSignal()
-	}
-
-	for {
-		r1, _, errNo := unix.Syscall(unix.SYS_BPF, uintptr(cmd), uintptr(attr), size)
-		runtime.KeepAlive(attr)
-
-		// As of ~4.20 the verifier can be interrupted by a signal,
-		// and returns EAGAIN in that case.
-		if errNo == unix.EAGAIN && cmd == BPF_PROG_LOAD {
-			continue
-		}
-
-		var err error
-		if errNo != 0 {
-			err = wrappedErrno{errNo}
-		}
-
-		return r1, err
-	}
-}
-
 // Info is implemented by all structs that can be passed to the ObjInfo syscall.
 //
 //	MapInfo
@@ -124,7 +94,7 @@ func ObjInfo(fd *FD, info Info) error {
 	err := ObjGetInfoByFd(&ObjGetInfoByFdAttr{
 		BpfFd:   fd.Uint(),
 		InfoLen: len,
-		Info:    NewPointer(ptr),
+		Info:    UnsafePointer(ptr),
 	})
 	runtime.KeepAlive(fd)
 	return err
@@ -150,6 +120,12 @@ const (
 	BPF_LOG_STATS
 )
 
+// MapID uniquely identifies a bpf_map.
+type MapID uint32
+
+// ProgramID uniquely identifies a bpf_map.
+type ProgramID uint32
+
 // LinkID uniquely identifies a bpf_link.
 type LinkID uint32
 
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/syscall_other.go b/vendor/github.com/cilium/ebpf/internal/sys/syscall_other.go
new file mode 100644
index 0000000000000000000000000000000000000000..b99e6e462d85c119e3de9d261496aaab4aa6af9c
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/sys/syscall_other.go
@@ -0,0 +1,84 @@
+//go:build !windows
+
+package sys
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"unsafe"
+
+	"github.com/cilium/ebpf/internal/unix"
+)
+
+// BPF wraps SYS_BPF.
+//
+// Any pointers contained in attr must use the Pointer type from this package.
+func BPF(cmd Cmd, attr unsafe.Pointer, size uintptr) (uintptr, error) {
+	// Prevent the Go profiler from repeatedly interrupting the verifier,
+	// which could otherwise lead to a livelock due to receiving EAGAIN.
+	if cmd == BPF_PROG_LOAD || cmd == BPF_PROG_RUN {
+		maskProfilerSignal()
+		defer unmaskProfilerSignal()
+	}
+
+	for {
+		r1, _, errNo := unix.Syscall(unix.SYS_BPF, uintptr(cmd), uintptr(attr), size)
+		runtime.KeepAlive(attr)
+
+		// As of ~4.20 the verifier can be interrupted by a signal,
+		// and returns EAGAIN in that case.
+		if errNo == unix.EAGAIN && cmd == BPF_PROG_LOAD {
+			continue
+		}
+
+		var err error
+		if errNo != 0 {
+			err = wrappedErrno{errNo}
+		}
+
+		return r1, err
+	}
+}
+
+// ObjGetTyped wraps [ObjGet] with a readlink call to extract the type of the
+// underlying bpf object.
+func ObjGetTyped(attr *ObjGetAttr) (*FD, ObjType, error) {
+	fd, err := ObjGet(attr)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	typ, err := readType(fd)
+	if err != nil {
+		_ = fd.Close()
+		return nil, 0, fmt.Errorf("reading fd type: %w", err)
+	}
+
+	return fd, typ, nil
+}
+
+// readType returns the bpf object type of the file descriptor by calling
+// readlink(3). Returns an error if the file descriptor does not represent a bpf
+// object.
+func readType(fd *FD) (ObjType, error) {
+	s, err := os.Readlink(filepath.Join("/proc/self/fd/", fd.String()))
+	if err != nil {
+		return 0, fmt.Errorf("readlink fd %d: %w", fd.Int(), err)
+	}
+
+	s = strings.TrimPrefix(s, "anon_inode:")
+
+	switch s {
+	case "bpf-map":
+		return BPF_TYPE_MAP, nil
+	case "bpf-prog":
+		return BPF_TYPE_PROG, nil
+	case "bpf-link":
+		return BPF_TYPE_LINK, nil
+	}
+
+	return 0, fmt.Errorf("unknown type %s of fd %d", s, fd.Int())
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/syscall_windows.go b/vendor/github.com/cilium/ebpf/internal/sys/syscall_windows.go
new file mode 100644
index 0000000000000000000000000000000000000000..08f73805c6067cbaee4c65de532c34ec27d0829d
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/sys/syscall_windows.go
@@ -0,0 +1,69 @@
+package sys
+
+import (
+	"fmt"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+
+	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/efw"
+	"github.com/cilium/ebpf/internal/unix"
+)
+
+// BPF calls the BPF syscall wrapper in ebpfapi.dll.
+//
+// Any pointers contained in attr must use the Pointer type from this package.
+//
+// The implementation lives in https://github.com/microsoft/ebpf-for-windows/blob/main/libs/api/bpf_syscall.cpp
+func BPF(cmd Cmd, attr unsafe.Pointer, size uintptr) (uintptr, error) {
+	// On Linux we need to guard against preemption by the profiler here. On
+	// Windows it seems like a cgocall may not be preempted:
+	// https://github.com/golang/go/blob/8b51146c698bcfcc2c2b73fa9390db5230f2ce0a/src/runtime/os_windows.go#L1240-L1246
+
+	addr, err := efw.BPF.Find()
+	if err != nil {
+		return 0, err
+	}
+
+	// Using [LazyProc.Call] forces attr to escape, which isn't the case when using syscall.Syscall directly.
+	r1, _, lastError := syscall.SyscallN(addr, uintptr(cmd), uintptr(attr), size)
+
+	if ret := int(efw.Int(r1)); ret < 0 {
+		errNo := unix.Errno(-ret)
+		if errNo == unix.EINVAL && lastError == windows.ERROR_CALL_NOT_IMPLEMENTED {
+			return 0, internal.ErrNotSupportedOnOS
+		}
+		return 0, wrappedErrno{errNo}
+	}
+
+	return r1, nil
+}
+
+// ObjGetTyped retrieves an pinned object and its type.
+func ObjGetTyped(attr *ObjGetAttr) (*FD, ObjType, error) {
+	fd, err := ObjGet(attr)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	efwType, err := efw.EbpfObjectGetInfoByFd(fd.Int(), nil, nil)
+	if err != nil {
+		_ = fd.Close()
+		return nil, 0, err
+	}
+
+	switch efwType {
+	case efw.EBPF_OBJECT_UNKNOWN:
+		return fd, BPF_TYPE_UNSPEC, nil
+	case efw.EBPF_OBJECT_MAP:
+		return fd, BPF_TYPE_MAP, nil
+	case efw.EBPF_OBJECT_LINK:
+		return fd, BPF_TYPE_LINK, nil
+	case efw.EBPF_OBJECT_PROGRAM:
+		return fd, BPF_TYPE_PROG, nil
+	default:
+		return nil, 0, fmt.Errorf("unrecognized object type %v", efwType)
+	}
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/sys/types.go b/vendor/github.com/cilium/ebpf/internal/sys/types.go
index 82f3492a83d8c49dd475739af07cc72486ea0394..a76d4a562d6581d68ef4dffb4096cdf7a533aaa5 100644
--- a/vendor/github.com/cilium/ebpf/internal/sys/types.go
+++ b/vendor/github.com/cilium/ebpf/internal/sys/types.go
@@ -3,6 +3,7 @@
 package sys
 
 import (
+	"structs"
 	"unsafe"
 )
 
@@ -689,20 +690,23 @@ const (
 )
 
 type BtfInfo struct {
-	Btf       Pointer
+	structs.HostLayout
+	Btf       TypedPointer[uint8]
 	BtfSize   uint32
 	Id        BTFID
-	Name      Pointer
+	Name      TypedPointer[uint8]
 	NameLen   uint32
 	KernelBtf uint32
 }
 
 type FuncInfo struct {
+	structs.HostLayout
 	InsnOff uint32
 	TypeId  uint32
 }
 
 type LineInfo struct {
+	structs.HostLayout
 	InsnOff     uint32
 	FileNameOff uint32
 	LineOff     uint32
@@ -710,6 +714,7 @@ type LineInfo struct {
 }
 
 type LinkInfo struct {
+	structs.HostLayout
 	Type   LinkType
 	Id     LinkID
 	ProgId uint32
@@ -718,8 +723,9 @@ type LinkInfo struct {
 }
 
 type MapInfo struct {
+	structs.HostLayout
 	Type                  uint32
-	Id                    uint32
+	Id                    MapID
 	KeySize               uint32
 	ValueSize             uint32
 	MaxEntries            uint32
@@ -737,17 +743,18 @@ type MapInfo struct {
 }
 
 type ProgInfo struct {
+	structs.HostLayout
 	Type                 uint32
 	Id                   uint32
 	Tag                  [8]uint8
 	JitedProgLen         uint32
 	XlatedProgLen        uint32
-	JitedProgInsns       Pointer
-	XlatedProgInsns      Pointer
+	JitedProgInsns       TypedPointer[uint8]
+	XlatedProgInsns      TypedPointer[uint8]
 	LoadTime             uint64
 	CreatedByUid         uint32
 	NrMapIds             uint32
-	MapIds               Pointer
+	MapIds               TypedPointer[MapID]
 	Name                 ObjName
 	Ifindex              uint32
 	_                    [4]byte /* unsupported bitfield */
@@ -755,15 +762,15 @@ type ProgInfo struct {
 	NetnsIno             uint64
 	NrJitedKsyms         uint32
 	NrJitedFuncLens      uint32
-	JitedKsyms           Pointer
-	JitedFuncLens        Pointer
+	JitedKsyms           TypedPointer[uint64]
+	JitedFuncLens        TypedPointer[uint32]
 	BtfId                BTFID
 	FuncInfoRecSize      uint32
-	FuncInfo             Pointer
+	FuncInfo             TypedPointer[uint8]
 	NrFuncInfo           uint32
 	NrLineInfo           uint32
-	LineInfo             Pointer
-	JitedLineInfo        Pointer
+	LineInfo             TypedPointer[uint8]
+	JitedLineInfo        TypedPointer[uint64]
 	NrJitedLineInfo      uint32
 	LineInfoRecSize      uint32
 	JitedLineInfoRecSize uint32
@@ -779,6 +786,7 @@ type ProgInfo struct {
 }
 
 type SkLookup struct {
+	structs.HostLayout
 	Cookie         uint64
 	Family         uint32
 	Protocol       uint32
@@ -794,6 +802,7 @@ type SkLookup struct {
 }
 
 type XdpMd struct {
+	structs.HostLayout
 	Data           uint32
 	DataEnd        uint32
 	DataMeta       uint32
@@ -802,7 +811,10 @@ type XdpMd struct {
 	EgressIfindex  uint32
 }
 
-type BtfGetFdByIdAttr struct{ Id uint32 }
+type BtfGetFdByIdAttr struct {
+	structs.HostLayout
+	Id uint32
+}
 
 func BtfGetFdById(attr *BtfGetFdByIdAttr) (*FD, error) {
 	fd, err := BPF(BPF_BTF_GET_FD_BY_ID, unsafe.Pointer(attr), unsafe.Sizeof(*attr))
@@ -813,6 +825,7 @@ func BtfGetFdById(attr *BtfGetFdByIdAttr) (*FD, error) {
 }
 
 type BtfGetNextIdAttr struct {
+	structs.HostLayout
 	Id     BTFID
 	NextId BTFID
 }
@@ -823,8 +836,9 @@ func BtfGetNextId(attr *BtfGetNextIdAttr) error {
 }
 
 type BtfLoadAttr struct {
-	Btf            Pointer
-	BtfLogBuf      Pointer
+	structs.HostLayout
+	Btf            TypedPointer[uint8]
+	BtfLogBuf      TypedPointer[uint8]
 	BtfSize        uint32
 	BtfLogSize     uint32
 	BtfLogLevel    uint32
@@ -841,7 +855,10 @@ func BtfLoad(attr *BtfLoadAttr) (*FD, error) {
 	return NewFD(int(fd))
 }
 
-type EnableStatsAttr struct{ Type uint32 }
+type EnableStatsAttr struct {
+	structs.HostLayout
+	Type uint32
+}
 
 func EnableStats(attr *EnableStatsAttr) (*FD, error) {
 	fd, err := BPF(BPF_ENABLE_STATS, unsafe.Pointer(attr), unsafe.Sizeof(*attr))
@@ -852,6 +869,7 @@ func EnableStats(attr *EnableStatsAttr) (*FD, error) {
 }
 
 type IterCreateAttr struct {
+	structs.HostLayout
 	LinkFd uint32
 	Flags  uint32
 }
@@ -865,6 +883,7 @@ func IterCreate(attr *IterCreateAttr) (*FD, error) {
 }
 
 type LinkCreateAttr struct {
+	structs.HostLayout
 	ProgFd      uint32
 	TargetFd    uint32
 	AttachType  AttachType
@@ -882,6 +901,7 @@ func LinkCreate(attr *LinkCreateAttr) (*FD, error) {
 }
 
 type LinkCreateIterAttr struct {
+	structs.HostLayout
 	ProgFd      uint32
 	TargetFd    uint32
 	AttachType  AttachType
@@ -900,15 +920,16 @@ func LinkCreateIter(attr *LinkCreateIterAttr) (*FD, error) {
 }
 
 type LinkCreateKprobeMultiAttr struct {
+	structs.HostLayout
 	ProgFd           uint32
 	TargetFd         uint32
 	AttachType       AttachType
 	Flags            uint32
 	KprobeMultiFlags uint32
 	Count            uint32
-	Syms             Pointer
-	Addrs            Pointer
-	Cookies          Pointer
+	Syms             StringSlicePointer
+	Addrs            TypedPointer[uintptr]
+	Cookies          TypedPointer[uint64]
 	_                [16]byte
 }
 
@@ -921,6 +942,7 @@ func LinkCreateKprobeMulti(attr *LinkCreateKprobeMultiAttr) (*FD, error) {
 }
 
 type LinkCreateNetfilterAttr struct {
+	structs.HostLayout
 	ProgFd         uint32
 	TargetFd       uint32
 	AttachType     AttachType
@@ -941,6 +963,7 @@ func LinkCreateNetfilter(attr *LinkCreateNetfilterAttr) (*FD, error) {
 }
 
 type LinkCreateNetkitAttr struct {
+	structs.HostLayout
 	ProgFd           uint32
 	TargetIfindex    uint32
 	AttachType       AttachType
@@ -960,6 +983,7 @@ func LinkCreateNetkit(attr *LinkCreateNetkitAttr) (*FD, error) {
 }
 
 type LinkCreatePerfEventAttr struct {
+	structs.HostLayout
 	ProgFd     uint32
 	TargetFd   uint32
 	AttachType AttachType
@@ -977,6 +1001,7 @@ func LinkCreatePerfEvent(attr *LinkCreatePerfEventAttr) (*FD, error) {
 }
 
 type LinkCreateTcxAttr struct {
+	structs.HostLayout
 	ProgFd           uint32
 	TargetIfindex    uint32
 	AttachType       AttachType
@@ -996,6 +1021,7 @@ func LinkCreateTcx(attr *LinkCreateTcxAttr) (*FD, error) {
 }
 
 type LinkCreateTracingAttr struct {
+	structs.HostLayout
 	ProgFd      uint32
 	TargetFd    uint32
 	AttachType  AttachType
@@ -1015,14 +1041,15 @@ func LinkCreateTracing(attr *LinkCreateTracingAttr) (*FD, error) {
 }
 
 type LinkCreateUprobeMultiAttr struct {
+	structs.HostLayout
 	ProgFd           uint32
 	TargetFd         uint32
 	AttachType       AttachType
 	Flags            uint32
-	Path             Pointer
-	Offsets          Pointer
-	RefCtrOffsets    Pointer
-	Cookies          Pointer
+	Path             StringPointer
+	Offsets          TypedPointer[uint64]
+	RefCtrOffsets    TypedPointer[uint64]
+	Cookies          TypedPointer[uint64]
 	Count            uint32
 	UprobeMultiFlags uint32
 	Pid              uint32
@@ -1037,7 +1064,10 @@ func LinkCreateUprobeMulti(attr *LinkCreateUprobeMultiAttr) (*FD, error) {
 	return NewFD(int(fd))
 }
 
-type LinkGetFdByIdAttr struct{ Id LinkID }
+type LinkGetFdByIdAttr struct {
+	structs.HostLayout
+	Id LinkID
+}
 
 func LinkGetFdById(attr *LinkGetFdByIdAttr) (*FD, error) {
 	fd, err := BPF(BPF_LINK_GET_FD_BY_ID, unsafe.Pointer(attr), unsafe.Sizeof(*attr))
@@ -1048,6 +1078,7 @@ func LinkGetFdById(attr *LinkGetFdByIdAttr) (*FD, error) {
 }
 
 type LinkGetNextIdAttr struct {
+	structs.HostLayout
 	Id     LinkID
 	NextId LinkID
 }
@@ -1058,6 +1089,7 @@ func LinkGetNextId(attr *LinkGetNextIdAttr) error {
 }
 
 type LinkUpdateAttr struct {
+	structs.HostLayout
 	LinkFd    uint32
 	NewProgFd uint32
 	Flags     uint32
@@ -1070,6 +1102,7 @@ func LinkUpdate(attr *LinkUpdateAttr) error {
 }
 
 type MapCreateAttr struct {
+	structs.HostLayout
 	MapType               MapType
 	KeySize               uint32
 	ValueSize             uint32
@@ -1097,6 +1130,7 @@ func MapCreate(attr *MapCreateAttr) (*FD, error) {
 }
 
 type MapDeleteBatchAttr struct {
+	structs.HostLayout
 	InBatch   Pointer
 	OutBatch  Pointer
 	Keys      Pointer
@@ -1113,6 +1147,7 @@ func MapDeleteBatch(attr *MapDeleteBatchAttr) error {
 }
 
 type MapDeleteElemAttr struct {
+	structs.HostLayout
 	MapFd uint32
 	_     [4]byte
 	Key   Pointer
@@ -1125,14 +1160,20 @@ func MapDeleteElem(attr *MapDeleteElemAttr) error {
 	return err
 }
 
-type MapFreezeAttr struct{ MapFd uint32 }
+type MapFreezeAttr struct {
+	structs.HostLayout
+	MapFd uint32
+}
 
 func MapFreeze(attr *MapFreezeAttr) error {
 	_, err := BPF(BPF_MAP_FREEZE, unsafe.Pointer(attr), unsafe.Sizeof(*attr))
 	return err
 }
 
-type MapGetFdByIdAttr struct{ Id uint32 }
+type MapGetFdByIdAttr struct {
+	structs.HostLayout
+	Id uint32
+}
 
 func MapGetFdById(attr *MapGetFdByIdAttr) (*FD, error) {
 	fd, err := BPF(BPF_MAP_GET_FD_BY_ID, unsafe.Pointer(attr), unsafe.Sizeof(*attr))
@@ -1143,6 +1184,7 @@ func MapGetFdById(attr *MapGetFdByIdAttr) (*FD, error) {
 }
 
 type MapGetNextIdAttr struct {
+	structs.HostLayout
 	Id     uint32
 	NextId uint32
 }
@@ -1153,6 +1195,7 @@ func MapGetNextId(attr *MapGetNextIdAttr) error {
 }
 
 type MapGetNextKeyAttr struct {
+	structs.HostLayout
 	MapFd   uint32
 	_       [4]byte
 	Key     Pointer
@@ -1165,6 +1208,7 @@ func MapGetNextKey(attr *MapGetNextKeyAttr) error {
 }
 
 type MapLookupAndDeleteBatchAttr struct {
+	structs.HostLayout
 	InBatch   Pointer
 	OutBatch  Pointer
 	Keys      Pointer
@@ -1181,6 +1225,7 @@ func MapLookupAndDeleteBatch(attr *MapLookupAndDeleteBatchAttr) error {
 }
 
 type MapLookupAndDeleteElemAttr struct {
+	structs.HostLayout
 	MapFd uint32
 	_     [4]byte
 	Key   Pointer
@@ -1194,6 +1239,7 @@ func MapLookupAndDeleteElem(attr *MapLookupAndDeleteElemAttr) error {
 }
 
 type MapLookupBatchAttr struct {
+	structs.HostLayout
 	InBatch   Pointer
 	OutBatch  Pointer
 	Keys      Pointer
@@ -1210,6 +1256,7 @@ func MapLookupBatch(attr *MapLookupBatchAttr) error {
 }
 
 type MapLookupElemAttr struct {
+	structs.HostLayout
 	MapFd uint32
 	_     [4]byte
 	Key   Pointer
@@ -1223,6 +1270,7 @@ func MapLookupElem(attr *MapLookupElemAttr) error {
 }
 
 type MapUpdateBatchAttr struct {
+	structs.HostLayout
 	InBatch   Pointer
 	OutBatch  Pointer
 	Keys      Pointer
@@ -1239,6 +1287,7 @@ func MapUpdateBatch(attr *MapUpdateBatchAttr) error {
 }
 
 type MapUpdateElemAttr struct {
+	structs.HostLayout
 	MapFd uint32
 	_     [4]byte
 	Key   Pointer
@@ -1252,7 +1301,8 @@ func MapUpdateElem(attr *MapUpdateElemAttr) error {
 }
 
 type ObjGetAttr struct {
-	Pathname  Pointer
+	structs.HostLayout
+	Pathname  StringPointer
 	BpfFd     uint32
 	FileFlags uint32
 	PathFd    int32
@@ -1268,6 +1318,7 @@ func ObjGet(attr *ObjGetAttr) (*FD, error) {
 }
 
 type ObjGetInfoByFdAttr struct {
+	structs.HostLayout
 	BpfFd   uint32
 	InfoLen uint32
 	Info    Pointer
@@ -1279,7 +1330,8 @@ func ObjGetInfoByFd(attr *ObjGetInfoByFdAttr) error {
 }
 
 type ObjPinAttr struct {
-	Pathname  Pointer
+	structs.HostLayout
+	Pathname  StringPointer
 	BpfFd     uint32
 	FileFlags uint32
 	PathFd    int32
@@ -1292,6 +1344,7 @@ func ObjPin(attr *ObjPinAttr) error {
 }
 
 type ProgAttachAttr struct {
+	structs.HostLayout
 	TargetFdOrIfindex uint32
 	AttachBpfFd       uint32
 	AttachType        uint32
@@ -1307,6 +1360,7 @@ func ProgAttach(attr *ProgAttachAttr) error {
 }
 
 type ProgBindMapAttr struct {
+	structs.HostLayout
 	ProgFd uint32
 	MapFd  uint32
 	Flags  uint32
@@ -1318,6 +1372,7 @@ func ProgBindMap(attr *ProgBindMapAttr) error {
 }
 
 type ProgDetachAttr struct {
+	structs.HostLayout
 	TargetFdOrIfindex uint32
 	AttachBpfFd       uint32
 	AttachType        uint32
@@ -1332,7 +1387,10 @@ func ProgDetach(attr *ProgDetachAttr) error {
 	return err
 }
 
-type ProgGetFdByIdAttr struct{ Id uint32 }
+type ProgGetFdByIdAttr struct {
+	structs.HostLayout
+	Id uint32
+}
 
 func ProgGetFdById(attr *ProgGetFdByIdAttr) (*FD, error) {
 	fd, err := BPF(BPF_PROG_GET_FD_BY_ID, unsafe.Pointer(attr), unsafe.Sizeof(*attr))
@@ -1343,6 +1401,7 @@ func ProgGetFdById(attr *ProgGetFdByIdAttr) (*FD, error) {
 }
 
 type ProgGetNextIdAttr struct {
+	structs.HostLayout
 	Id     uint32
 	NextId uint32
 }
@@ -1353,13 +1412,14 @@ func ProgGetNextId(attr *ProgGetNextIdAttr) error {
 }
 
 type ProgLoadAttr struct {
+	structs.HostLayout
 	ProgType           ProgType
 	InsnCnt            uint32
-	Insns              Pointer
-	License            Pointer
+	Insns              TypedPointer[uint8]
+	License            StringPointer
 	LogLevel           LogLevel
 	LogSize            uint32
-	LogBuf             Pointer
+	LogBuf             TypedPointer[uint8]
 	KernVersion        uint32
 	ProgFlags          uint32
 	ProgName           ObjName
@@ -1367,16 +1427,16 @@ type ProgLoadAttr struct {
 	ExpectedAttachType AttachType
 	ProgBtfFd          uint32
 	FuncInfoRecSize    uint32
-	FuncInfo           Pointer
+	FuncInfo           TypedPointer[uint8]
 	FuncInfoCnt        uint32
 	LineInfoRecSize    uint32
-	LineInfo           Pointer
+	LineInfo           TypedPointer[uint8]
 	LineInfoCnt        uint32
 	AttachBtfId        TypeID
 	AttachBtfObjFd     uint32
 	CoreReloCnt        uint32
-	FdArray            Pointer
-	CoreRelos          Pointer
+	FdArray            TypedPointer[int32]
+	CoreRelos          TypedPointer[uint8]
 	CoreReloRecSize    uint32
 	LogTrueSize        uint32
 	ProgTokenFd        int32
@@ -1392,16 +1452,17 @@ func ProgLoad(attr *ProgLoadAttr) (*FD, error) {
 }
 
 type ProgQueryAttr struct {
+	structs.HostLayout
 	TargetFdOrIfindex uint32
 	AttachType        AttachType
 	QueryFlags        uint32
 	AttachFlags       uint32
-	ProgIds           Pointer
+	ProgIds           TypedPointer[ProgramID]
 	Count             uint32
 	_                 [4]byte
-	ProgAttachFlags   Pointer
-	LinkIds           Pointer
-	LinkAttachFlags   Pointer
+	ProgAttachFlags   TypedPointer[ProgramID]
+	LinkIds           TypedPointer[LinkID]
+	LinkAttachFlags   TypedPointer[LinkID]
 	Revision          uint64
 }
 
@@ -1411,18 +1472,19 @@ func ProgQuery(attr *ProgQueryAttr) error {
 }
 
 type ProgRunAttr struct {
+	structs.HostLayout
 	ProgFd      uint32
 	Retval      uint32
 	DataSizeIn  uint32
 	DataSizeOut uint32
-	DataIn      Pointer
-	DataOut     Pointer
+	DataIn      TypedPointer[uint8]
+	DataOut     TypedPointer[uint8]
 	Repeat      uint32
 	Duration    uint32
 	CtxSizeIn   uint32
 	CtxSizeOut  uint32
-	CtxIn       Pointer
-	CtxOut      Pointer
+	CtxIn       TypedPointer[uint8]
+	CtxOut      TypedPointer[uint8]
 	Flags       uint32
 	Cpu         uint32
 	BatchSize   uint32
@@ -1435,7 +1497,8 @@ func ProgRun(attr *ProgRunAttr) error {
 }
 
 type RawTracepointOpenAttr struct {
-	Name   Pointer
+	structs.HostLayout
+	Name   StringPointer
 	ProgFd uint32
 	_      [4]byte
 	Cookie uint64
@@ -1450,6 +1513,7 @@ func RawTracepointOpen(attr *RawTracepointOpenAttr) (*FD, error) {
 }
 
 type CgroupLinkInfo struct {
+	structs.HostLayout
 	Type       LinkType
 	Id         LinkID
 	ProgId     uint32
@@ -1460,22 +1524,24 @@ type CgroupLinkInfo struct {
 }
 
 type IterLinkInfo struct {
+	structs.HostLayout
 	Type          LinkType
 	Id            LinkID
 	ProgId        uint32
 	_             [4]byte
-	TargetName    Pointer
+	TargetName    TypedPointer[uint8]
 	TargetNameLen uint32
 }
 
 type KprobeLinkInfo struct {
+	structs.HostLayout
 	Type          LinkType
 	Id            LinkID
 	ProgId        uint32
 	_             [4]byte
 	PerfEventType PerfEventType
 	_             [4]byte
-	FuncName      Pointer
+	FuncName      TypedPointer[uint8]
 	NameLen       uint32
 	Offset        uint32
 	Addr          uint64
@@ -1484,19 +1550,21 @@ type KprobeLinkInfo struct {
 }
 
 type KprobeMultiLinkInfo struct {
+	structs.HostLayout
 	Type    LinkType
 	Id      LinkID
 	ProgId  uint32
 	_       [4]byte
-	Addrs   Pointer
+	Addrs   TypedPointer[uint64]
 	Count   uint32
 	Flags   uint32
 	Missed  uint64
-	Cookies uint64
+	Cookies TypedPointer[uint64]
 	_       [16]byte
 }
 
 type NetNsLinkInfo struct {
+	structs.HostLayout
 	Type       LinkType
 	Id         LinkID
 	ProgId     uint32
@@ -1507,6 +1575,7 @@ type NetNsLinkInfo struct {
 }
 
 type NetfilterLinkInfo struct {
+	structs.HostLayout
 	Type     LinkType
 	Id       LinkID
 	ProgId   uint32
@@ -1519,6 +1588,7 @@ type NetfilterLinkInfo struct {
 }
 
 type NetkitLinkInfo struct {
+	structs.HostLayout
 	Type       LinkType
 	Id         LinkID
 	ProgId     uint32
@@ -1529,6 +1599,7 @@ type NetkitLinkInfo struct {
 }
 
 type PerfEventLinkInfo struct {
+	structs.HostLayout
 	Type          LinkType
 	Id            LinkID
 	ProgId        uint32
@@ -1537,16 +1608,18 @@ type PerfEventLinkInfo struct {
 }
 
 type RawTracepointLinkInfo struct {
+	structs.HostLayout
 	Type      LinkType
 	Id        LinkID
 	ProgId    uint32
 	_         [4]byte
-	TpName    Pointer
+	TpName    TypedPointer[uint8]
 	TpNameLen uint32
 	_         [36]byte
 }
 
 type TcxLinkInfo struct {
+	structs.HostLayout
 	Type       LinkType
 	Id         LinkID
 	ProgId     uint32
@@ -1557,6 +1630,7 @@ type TcxLinkInfo struct {
 }
 
 type TracingLinkInfo struct {
+	structs.HostLayout
 	Type        LinkType
 	Id          LinkID
 	ProgId      uint32
@@ -1568,6 +1642,7 @@ type TracingLinkInfo struct {
 }
 
 type XDPLinkInfo struct {
+	structs.HostLayout
 	Type    LinkType
 	Id      LinkID
 	ProgId  uint32
diff --git a/vendor/github.com/cilium/ebpf/internal/sysenc/buffer.go b/vendor/github.com/cilium/ebpf/internal/sysenc/buffer.go
index 1b4f052ee2b8203f9b9ce2e0efdcfbe3376a4a66..62e483a1c412a89939a0d46eea6c53a4300b62e4 100644
--- a/vendor/github.com/cilium/ebpf/internal/sysenc/buffer.go
+++ b/vendor/github.com/cilium/ebpf/internal/sysenc/buffer.go
@@ -63,7 +63,7 @@ func (b Buffer) AppendTo(dst []byte) []byte {
 func (b Buffer) Pointer() sys.Pointer {
 	// NB: This deliberately ignores b.length to support zero-copy
 	// marshaling / unmarshaling using unsafe.Pointer.
-	return sys.NewPointer(b.ptr)
+	return sys.UnsafePointer(b.ptr)
 }
 
 // Unmarshal the buffer into the provided value.
diff --git a/vendor/github.com/cilium/ebpf/internal/sysenc/marshal.go b/vendor/github.com/cilium/ebpf/internal/sysenc/marshal.go
index 0026af8f24fb5f615a480251db1d8501708dbcd1..9a0e10cde7f88c568152fbc0d79c52bd74dba69d 100644
--- a/vendor/github.com/cilium/ebpf/internal/sysenc/marshal.go
+++ b/vendor/github.com/cilium/ebpf/internal/sysenc/marshal.go
@@ -1,14 +1,12 @@
 package sysenc
 
 import (
-	"bytes"
 	"encoding"
 	"encoding/binary"
 	"errors"
 	"fmt"
 	"reflect"
 	"slices"
-	"sync"
 	"unsafe"
 
 	"github.com/cilium/ebpf/internal"
@@ -70,16 +68,10 @@ func Marshal(data any, size int) (Buffer, error) {
 	return newBuffer(buf), nil
 }
 
-var bytesReaderPool = sync.Pool{
-	New: func() interface{} {
-		return new(bytes.Reader)
-	},
-}
-
 // Unmarshal a byte slice in the system's native endianness into data.
 //
 // Returns an error if buf can't be unmarshalled according to the behaviour
-// of [binary.Read].
+// of [binary.Decode].
 func Unmarshal(data interface{}, buf []byte) error {
 	switch value := data.(type) {
 	case encoding.BinaryUnmarshaler:
@@ -100,16 +92,12 @@ func Unmarshal(data interface{}, buf []byte) error {
 			return nil
 		}
 
-		rd := bytesReaderPool.Get().(*bytes.Reader)
-		defer bytesReaderPool.Put(rd)
-
-		rd.Reset(buf)
-
-		if err := binary.Read(rd, internal.NativeEndian, value); err != nil {
+		n, err := binary.Decode(buf, internal.NativeEndian, value)
+		if err != nil {
 			return err
 		}
 
-		if rd.Len() != 0 {
+		if n != len(buf) {
 			return fmt.Errorf("unmarshaling %T doesn't consume all data", data)
 		}
 
diff --git a/vendor/github.com/cilium/ebpf/internal/testutils/fdtrace/main.go b/vendor/github.com/cilium/ebpf/internal/testutils/fdtrace/main.go
deleted file mode 100644
index c1f7b42d91d3ef44af5a16adea5f33de0ac0110a..0000000000000000000000000000000000000000
--- a/vendor/github.com/cilium/ebpf/internal/testutils/fdtrace/main.go
+++ /dev/null
@@ -1,31 +0,0 @@
-package fdtrace
-
-import (
-	"os"
-	"sync"
-)
-
-type testingM interface {
-	Run() int
-}
-
-// TestMain runs m with fd tracing enabled.
-//
-// The function calls [os.Exit] and does not return.
-func TestMain(m testingM) {
-	fds = new(sync.Map)
-
-	ret := m.Run()
-
-	if fs := flushFrames(); len(fs) != 0 {
-		for _, f := range fs {
-			onLeakFD(f)
-		}
-	}
-
-	if foundLeak.Load() {
-		ret = 99
-	}
-
-	os.Exit(ret)
-}
diff --git a/vendor/github.com/cilium/ebpf/internal/testutils/fdtrace/fd_trace.go b/vendor/github.com/cilium/ebpf/internal/testutils/testmain/fd_trace.go
similarity index 99%
rename from vendor/github.com/cilium/ebpf/internal/testutils/fdtrace/fd_trace.go
rename to vendor/github.com/cilium/ebpf/internal/testutils/testmain/fd_trace.go
index 562df2cc0c225edf6b25db520832c836bf21a82f..c47acf89ceded8f5c3e4fe27172c0b6a257a0fdb 100644
--- a/vendor/github.com/cilium/ebpf/internal/testutils/fdtrace/fd_trace.go
+++ b/vendor/github.com/cilium/ebpf/internal/testutils/testmain/fd_trace.go
@@ -1,4 +1,4 @@
-package fdtrace
+package testmain
 
 import (
 	"bytes"
diff --git a/vendor/github.com/cilium/ebpf/internal/testutils/testmain/main.go b/vendor/github.com/cilium/ebpf/internal/testutils/testmain/main.go
new file mode 100644
index 0000000000000000000000000000000000000000..53de97c863674baf2ca63cd7d572b2f05b8daf78
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/testutils/testmain/main.go
@@ -0,0 +1,58 @@
+package testmain
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"sync"
+
+	"github.com/cilium/ebpf/internal/platform"
+)
+
+type testingM interface {
+	Run() int
+}
+
+// Run m with various debug aids enabled.
+//
+// The function calls [os.Exit] and does not return.
+func Run(m testingM) {
+	const traceLogFlag = "trace-log"
+
+	var ts *traceSession
+	if platform.IsWindows {
+		traceLog := flag.Bool(traceLogFlag, false, "Output a trace of eBPF runtime activity")
+		flag.Parse()
+
+		if *traceLog {
+			var err error
+			ts, err = newTraceSession()
+			if err != nil {
+				fmt.Fprintln(os.Stderr, "Disabling trace logging:", err)
+			}
+		}
+	}
+	defer ts.Close()
+
+	fds = new(sync.Map)
+	ret := m.Run()
+
+	for _, f := range flushFrames() {
+		onLeakFD(f)
+	}
+
+	if foundLeak.Load() {
+		ret = 99
+	}
+
+	if err := ts.Dump(os.Stderr); err != nil {
+		fmt.Fprintln(os.Stderr, "Error while dumping trace log:", err)
+		ret = 99
+	}
+
+	if platform.IsWindows && ret != 0 && ts == nil {
+		fmt.Fprintf(os.Stderr, "Consider enabling trace logging with -%s\n", traceLogFlag)
+	}
+
+	os.Exit(ret)
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/testutils/testmain/windows.go b/vendor/github.com/cilium/ebpf/internal/testutils/testmain/windows.go
new file mode 100644
index 0000000000000000000000000000000000000000..533af9dbb2891f541072b3439f17bf216d879e71
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/internal/testutils/testmain/windows.go
@@ -0,0 +1,219 @@
+package testmain
+
+import (
+	"encoding/xml"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"text/tabwriter"
+)
+
+type tracelogKeywords uint64
+
+// Know tracelog keywords.
+//
+// See https://github.com/microsoft/ebpf-for-windows/blob/main/libs/shared/ebpf_tracelog.h
+var allKeywords = []string{
+	"entry-exit",
+	"base",
+	"error",
+	"epoch",
+	"core",
+	"link",
+	"map",
+	"program",
+	"api",
+	"printk",
+	"native",
+}
+
+func (kw *tracelogKeywords) UnmarshalText(text []byte) error {
+	decoded, err := strconv.ParseUint(string(text), 0, 64)
+	if err != nil {
+		return fmt.Errorf("foo: %w", err)
+	}
+	*kw = tracelogKeywords(decoded)
+	return nil
+}
+
+func (kw tracelogKeywords) decode() []string {
+	var keywords []string
+	for _, keyword := range allKeywords {
+		if kw&1 > 0 {
+			keywords = append(keywords, keyword)
+		}
+		kw >>= 1
+	}
+	if kw > 0 {
+		keywords = append(keywords, fmt.Sprintf("0x%x", kw))
+	}
+	return keywords
+}
+
+type traceSession struct {
+	session string
+}
+
+// newTraceSession starts a trace log for eBPF for Windows related events.
+//
+// * https://github.com/microsoft/ebpf-for-windows/blob/main/docs/GettingStarted.md#using-tracing
+// * https://devblogs.microsoft.com/performance-diagnostics/controlling-the-event-session-name-with-the-instance-name/ and
+func newTraceSession() (*traceSession, error) {
+	def := filepath.Join(os.Getenv("ProgramFiles"), "ebpf-for-windows\\ebpfforwindows.wprp")
+	if _, err := os.Stat(def); err != nil {
+		return nil, err
+	}
+
+	session := fmt.Sprintf("epbf-go-%d", os.Getpid())
+	wpr := exec.Command("wpr.exe", "-start", def, "-filemode", "-instancename", session)
+	wpr.Stderr = os.Stderr
+	if err := wpr.Run(); err != nil {
+		return nil, err
+	}
+
+	return &traceSession{session}, nil
+}
+
+func (ts *traceSession) Close() error {
+	if ts == nil {
+		return nil
+	}
+
+	return ts.stop(os.DevNull)
+}
+
+func (ts *traceSession) stop(file string) error {
+	if ts.session == "" {
+		return nil
+	}
+
+	wpr := exec.Command("wpr.exe", "-stop", file, "-instancename", ts.session)
+	if err := wpr.Run(); err != nil {
+		return err
+	}
+
+	ts.session = ""
+	return nil
+}
+
+func (ts *traceSession) Dump(w io.Writer) error {
+	if ts == nil {
+		return nil
+	}
+
+	path, err := os.MkdirTemp("", "ebpf-go-trace")
+	if err != nil {
+		return err
+	}
+	defer os.RemoveAll(path)
+
+	trace := filepath.Join(path, "trace.etl")
+	if err := ts.stop(trace); err != nil {
+		return fmt.Errorf("write trace: %w", err)
+	}
+
+	netsh := exec.Command("netsh.exe", "trace", "convert", trace, "dump=XML")
+	if err := netsh.Run(); err != nil {
+		return err
+	}
+
+	f, err := os.Open(filepath.Join(path, "trace.xml"))
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	return summariseWPRTrace(f, w)
+}
+
+func summariseWPRTrace(r io.Reader, w io.Writer) error {
+	type nameValue struct {
+		Name  string `xml:"Name,attr"`
+		Value string `xml:",chardata"`
+	}
+
+	type event struct {
+		XMLName xml.Name `xml:"Event"`
+		System  struct {
+			Provider struct {
+				Name string `xml:"Name,attr"`
+			} `xml:"Provider"`
+			TimeCreated struct {
+				SystemTime string `xml:"SystemTime,attr"`
+			} `xml:"TimeCreated"`
+			Keywords tracelogKeywords `xml:"Keywords"`
+			Level    uint64           `xml:"Level"`
+		} `xml:"System"`
+		EventData struct {
+			Data []nameValue `xml:"Data"`
+		} `xml:"EventData"`
+		RenderingInfo struct {
+			Task string `xml:"Task"`
+		} `xml:"RenderingInfo"`
+	}
+
+	var events struct {
+		Events []event `xml:"Event"`
+	}
+
+	err := xml.NewDecoder(r).Decode(&events)
+	if err != nil {
+		return fmt.Errorf("unmarshal trace XML: %w", err)
+	}
+
+	tw := tabwriter.NewWriter(w, 0, 0, 1, ' ', 0)
+	for _, event := range events.Events {
+		if !strings.Contains(event.System.Provider.Name, "Ebpf") {
+			continue
+		}
+
+		flag := " "
+		// See https://learn.microsoft.com/en-us/windows/win32/api/traceloggingprovider/nf-traceloggingprovider-tracelogginglevel#remarks
+		if event.System.Level > 0 && event.System.Level <= 3 {
+			flag = "!"
+		}
+
+		kw := event.System.Keywords.decode()
+		fmt.Fprintf(tw, "%s\t%s\t", flag, strings.Join(kw, ","))
+
+		data := event.EventData.Data
+		slices.SortFunc(data, func(a, b nameValue) int {
+			return strings.Compare(a.Name, b.Name)
+		})
+
+		var first string
+		for _, name := range []string{
+			"Entry",
+			"Message",
+			"ErrorMessage",
+		} {
+			i := slices.IndexFunc(data, func(kv nameValue) bool {
+				return kv.Name == name
+			})
+
+			if i == -1 {
+				continue
+			}
+
+			first = data[i].Value
+			data = slices.Delete(data, i, i+1)
+			break
+		}
+
+		// NB: This may be empty.
+		fmt.Fprintf(tw, "%s\t", first)
+
+		for _, data := range data {
+			fmt.Fprintf(tw, "%s=%s\t", data.Name, data.Value)
+		}
+
+		fmt.Fprintln(tw)
+	}
+
+	return tw.Flush()
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/tracefs/kprobe.go b/vendor/github.com/cilium/ebpf/internal/tracefs/kprobe.go
index bdadf4d8eadbf0aa8d143ecf15e3e4d0c85e3b6f..7f7b3cba51fd0f05115bb982bb73a4f180c67103 100644
--- a/vendor/github.com/cilium/ebpf/internal/tracefs/kprobe.go
+++ b/vendor/github.com/cilium/ebpf/internal/tracefs/kprobe.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/cilium/ebpf/internal"
 	"github.com/cilium/ebpf/internal/linux"
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/unix"
 )
 
@@ -113,7 +114,7 @@ func sanitizeTracefsPath(path ...string) (string, error) {
 // but may be also be available at /sys/kernel/debug/tracing if debugfs is mounted.
 // The available tracefs paths will depends on distribution choices.
 var getTracefsPath = sync.OnceValues(func() (string, error) {
-	if !internal.OnLinux {
+	if !platform.IsLinux {
 		return "", fmt.Errorf("tracefs: %w", internal.ErrNotSupportedOnOS)
 	}
 
@@ -305,7 +306,11 @@ func NewEvent(args ProbeArgs) (*Event, error) {
 		if err := removeEvent(args.Type, event); err != nil {
 			return nil, fmt.Errorf("failed to remove spurious maxactive event: %s", err)
 		}
-		return nil, fmt.Errorf("create trace event with non-default maxactive: %w", internal.ErrNotSupported)
+
+		return nil, &internal.UnsupportedFeatureError{
+			MinimumVersion: internal.Version{4, 12},
+			Name:           "trace event with non-default maxactive",
+		}
 	}
 	if err != nil {
 		return nil, fmt.Errorf("get trace event id: %w", err)
diff --git a/vendor/github.com/cilium/ebpf/internal/unix/strings_other.go b/vendor/github.com/cilium/ebpf/internal/unix/strings_other.go
index 49e1fe21720298725c8ba98b9c32ee88ceded958..76f367aa855a63c04cef3031a5d8c1ccba8d0ae1 100644
--- a/vendor/github.com/cilium/ebpf/internal/unix/strings_other.go
+++ b/vendor/github.com/cilium/ebpf/internal/unix/strings_other.go
@@ -9,3 +9,7 @@ func BytePtrFromString(s string) (*byte, error) {
 func ByteSliceToString(s []byte) string {
 	return ""
 }
+
+func ByteSliceFromString(s string) ([]byte, error) {
+	return nil, errNonLinux()
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/unix/strings_windows.go b/vendor/github.com/cilium/ebpf/internal/unix/strings_windows.go
index 7e3d4da7773548dd1f5efb0d5cca7825810d7be2..00af5a968633c9f55e51130b90e3de8fb1a21878 100644
--- a/vendor/github.com/cilium/ebpf/internal/unix/strings_windows.go
+++ b/vendor/github.com/cilium/ebpf/internal/unix/strings_windows.go
@@ -17,3 +17,7 @@ func BytePtrFromString(s string) (*byte, error) {
 func ByteSliceToString(s []byte) string {
 	return windows.ByteSliceToString(s)
 }
+
+func ByteSliceFromString(s string) ([]byte, error) {
+	return windows.ByteSliceFromString(s)
+}
diff --git a/vendor/github.com/cilium/ebpf/internal/unix/types_linux.go b/vendor/github.com/cilium/ebpf/internal/unix/types_linux.go
index 385adf08b86bcf1f68f29cc230a48e7ca89f96b8..7225220d535a88aad45c963d533ef3a2911bc1b6 100644
--- a/vendor/github.com/cilium/ebpf/internal/unix/types_linux.go
+++ b/vendor/github.com/cilium/ebpf/internal/unix/types_linux.go
@@ -168,6 +168,10 @@ func ByteSliceToString(s []byte) string {
 	return linux.ByteSliceToString(s)
 }
 
+func ByteSliceFromString(s string) ([]byte, error) {
+	return linux.ByteSliceFromString(s)
+}
+
 func Renameat2(olddirfd int, oldpath string, newdirfd int, newpath string, flags uint) error {
 	return linux.Renameat2(olddirfd, oldpath, newdirfd, newpath, flags)
 }
diff --git a/vendor/github.com/cilium/ebpf/link/anchor.go b/vendor/github.com/cilium/ebpf/link/anchor.go
index 1a3b5f7681fc8b00f65791632c70be837b1b2288..10fbba079cf26d85e056b1c853726aac7dc0598b 100644
--- a/vendor/github.com/cilium/ebpf/link/anchor.go
+++ b/vendor/github.com/cilium/ebpf/link/anchor.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/cgroup.go b/vendor/github.com/cilium/ebpf/link/cgroup.go
index f17d34f03c038654b79ed9dff731718acf3f2eac..1f1416aa2b4575492a0727e3a10644e80f208d0f 100644
--- a/vendor/github.com/cilium/ebpf/link/cgroup.go
+++ b/vendor/github.com/cilium/ebpf/link/cgroup.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/iter.go b/vendor/github.com/cilium/ebpf/link/iter.go
index 0a39faef883823fddffef4436a667e035f237742..40bb69c708612a65a0fcc104f137d0c8239eb22c 100644
--- a/vendor/github.com/cilium/ebpf/link/iter.go
+++ b/vendor/github.com/cilium/ebpf/link/iter.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
@@ -42,7 +44,7 @@ func AttachIter(opts IterOptions) (*Iter, error) {
 	attr := sys.LinkCreateIterAttr{
 		ProgFd:      uint32(progFd),
 		AttachType:  sys.AttachType(ebpf.AttachTraceIter),
-		IterInfo:    sys.NewPointer(unsafe.Pointer(&info)),
+		IterInfo:    sys.UnsafePointer(unsafe.Pointer(&info)),
 		IterInfoLen: uint32(unsafe.Sizeof(info)),
 	}
 
@@ -75,7 +77,7 @@ func (it *Iter) Open() (io.ReadCloser, error) {
 		return nil, fmt.Errorf("can't create iterator: %w", err)
 	}
 
-	return fd.File("bpf_iter"), nil
+	return fd.File("bpf_iter")
 }
 
 // union bpf_iter_link_info.map
diff --git a/vendor/github.com/cilium/ebpf/link/kprobe.go b/vendor/github.com/cilium/ebpf/link/kprobe.go
index 6f93a27a254c8b611e0ea6e6291fdab0d354b9d7..0912e0a0822f3cb441bcc05edbed4045bcd4a17c 100644
--- a/vendor/github.com/cilium/ebpf/link/kprobe.go
+++ b/vendor/github.com/cilium/ebpf/link/kprobe.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/kprobe_multi.go b/vendor/github.com/cilium/ebpf/link/kprobe_multi.go
index f19f9f4c732176728e940ba84912871ef7875446..3a2b06a241235a3cdb0e3a6918fcb60db9a1f518 100644
--- a/vendor/github.com/cilium/ebpf/link/kprobe_multi.go
+++ b/vendor/github.com/cilium/ebpf/link/kprobe_multi.go
@@ -1,10 +1,11 @@
+//go:build !windows
+
 package link
 
 import (
 	"errors"
 	"fmt"
 	"os"
-	"unsafe"
 
 	"github.com/cilium/ebpf"
 	"github.com/cilium/ebpf/asm"
@@ -84,10 +85,10 @@ func kprobeMulti(prog *ebpf.Program, opts KprobeMultiOptions, flags uint32) (Lin
 		return nil, fmt.Errorf("one of Symbols or Addresses is required: %w", errInvalidInput)
 	}
 	if syms != 0 && addrs != 0 {
-		return nil, fmt.Errorf("Symbols and Addresses are mutually exclusive: %w", errInvalidInput)
+		return nil, fmt.Errorf("fields Symbols and Addresses are mutually exclusive: %w", errInvalidInput)
 	}
 	if cookies > 0 && cookies != syms && cookies != addrs {
-		return nil, fmt.Errorf("Cookies must be exactly Symbols or Addresses in length: %w", errInvalidInput)
+		return nil, fmt.Errorf("field Cookies must be exactly Symbols or Addresses in length: %w", errInvalidInput)
 	}
 
 	attachType := sys.BPF_TRACE_KPROBE_MULTI
@@ -108,11 +109,11 @@ func kprobeMulti(prog *ebpf.Program, opts KprobeMultiOptions, flags uint32) (Lin
 
 	case addrs != 0:
 		attr.Count = addrs
-		attr.Addrs = sys.NewPointer(unsafe.Pointer(&opts.Addresses[0]))
+		attr.Addrs = sys.SlicePointer(opts.Addresses)
 	}
 
 	if cookies != 0 {
-		attr.Cookies = sys.NewPointer(unsafe.Pointer(&opts.Cookies[0]))
+		attr.Cookies = sys.SlicePointer(opts.Cookies)
 	}
 
 	fd, err := sys.LinkCreateKprobeMulti(attr)
diff --git a/vendor/github.com/cilium/ebpf/link/link.go b/vendor/github.com/cilium/ebpf/link/link.go
index 796769f8ea462954870df0d7f1c3d88895d6e94a..425811e777e19ef4b0bc9bcc6ee2e78f038bdb17 100644
--- a/vendor/github.com/cilium/ebpf/link/link.go
+++ b/vendor/github.com/cilium/ebpf/link/link.go
@@ -11,6 +11,9 @@ import (
 	"github.com/cilium/ebpf/internal/sys"
 )
 
+// Type is the kind of link.
+type Type = sys.LinkType
+
 var ErrNotSupported = internal.ErrNotSupported
 
 // Link represents a Program attached to a BPF hook.
@@ -90,51 +93,6 @@ func LoadPinnedLink(fileName string, opts *ebpf.LoadPinOptions) (Link, error) {
 	return wrapRawLink(raw)
 }
 
-// wrap a RawLink in a more specific type if possible.
-//
-// The function takes ownership of raw and closes it on error.
-func wrapRawLink(raw *RawLink) (_ Link, err error) {
-	defer func() {
-		if err != nil {
-			raw.Close()
-		}
-	}()
-
-	info, err := raw.Info()
-	if err != nil {
-		return nil, err
-	}
-
-	switch info.Type {
-	case RawTracepointType:
-		return &rawTracepoint{*raw}, nil
-	case TracingType:
-		return &tracing{*raw}, nil
-	case CgroupType:
-		return &linkCgroup{*raw}, nil
-	case IterType:
-		return &Iter{*raw}, nil
-	case NetNsType:
-		return &NetNsLink{*raw}, nil
-	case KprobeMultiType:
-		return &kprobeMultiLink{*raw}, nil
-	case UprobeMultiType:
-		return &uprobeMultiLink{*raw}, nil
-	case PerfEventType:
-		return &perfEventLink{*raw, nil}, nil
-	case TCXType:
-		return &tcxLink{*raw}, nil
-	case NetfilterType:
-		return &netfilterLink{*raw}, nil
-	case NetkitType:
-		return &netkitLink{*raw}, nil
-	case XDPType:
-		return &xdpLink{*raw}, nil
-	default:
-		return raw, nil
-	}
-}
-
 // ID uniquely identifies a BPF link.
 type ID = sys.LinkID
 
@@ -160,158 +118,6 @@ type Info struct {
 	extra   interface{}
 }
 
-type TracingInfo struct {
-	AttachType  sys.AttachType
-	TargetObjId uint32
-	TargetBtfId sys.TypeID
-}
-
-type CgroupInfo struct {
-	CgroupId   uint64
-	AttachType sys.AttachType
-	_          [4]byte
-}
-
-type NetNsInfo struct {
-	NetnsIno   uint32
-	AttachType sys.AttachType
-}
-
-type TCXInfo struct {
-	Ifindex    uint32
-	AttachType sys.AttachType
-}
-
-type XDPInfo struct {
-	Ifindex uint32
-}
-
-type NetfilterInfo struct {
-	Pf       uint32
-	Hooknum  uint32
-	Priority int32
-	Flags    uint32
-}
-
-type NetkitInfo struct {
-	Ifindex    uint32
-	AttachType sys.AttachType
-}
-
-type KprobeMultiInfo struct {
-	count  uint32
-	flags  uint32
-	missed uint64
-}
-
-// AddressCount is the number of addresses hooked by the kprobe.
-func (kpm *KprobeMultiInfo) AddressCount() (uint32, bool) {
-	return kpm.count, kpm.count > 0
-}
-
-func (kpm *KprobeMultiInfo) Flags() (uint32, bool) {
-	return kpm.flags, kpm.count > 0
-}
-
-func (kpm *KprobeMultiInfo) Missed() (uint64, bool) {
-	return kpm.missed, kpm.count > 0
-}
-
-type PerfEventInfo struct {
-	Type  sys.PerfEventType
-	extra interface{}
-}
-
-func (r *PerfEventInfo) Kprobe() *KprobeInfo {
-	e, _ := r.extra.(*KprobeInfo)
-	return e
-}
-
-type KprobeInfo struct {
-	address uint64
-	missed  uint64
-}
-
-func (kp *KprobeInfo) Address() (uint64, bool) {
-	return kp.address, kp.address > 0
-}
-
-func (kp *KprobeInfo) Missed() (uint64, bool) {
-	return kp.missed, kp.address > 0
-}
-
-// Tracing returns tracing type-specific link info.
-//
-// Returns nil if the type-specific link info isn't available.
-func (r Info) Tracing() *TracingInfo {
-	e, _ := r.extra.(*TracingInfo)
-	return e
-}
-
-// Cgroup returns cgroup type-specific link info.
-//
-// Returns nil if the type-specific link info isn't available.
-func (r Info) Cgroup() *CgroupInfo {
-	e, _ := r.extra.(*CgroupInfo)
-	return e
-}
-
-// NetNs returns netns type-specific link info.
-//
-// Returns nil if the type-specific link info isn't available.
-func (r Info) NetNs() *NetNsInfo {
-	e, _ := r.extra.(*NetNsInfo)
-	return e
-}
-
-// XDP returns XDP type-specific link info.
-//
-// Returns nil if the type-specific link info isn't available.
-func (r Info) XDP() *XDPInfo {
-	e, _ := r.extra.(*XDPInfo)
-	return e
-}
-
-// TCX returns TCX type-specific link info.
-//
-// Returns nil if the type-specific link info isn't available.
-func (r Info) TCX() *TCXInfo {
-	e, _ := r.extra.(*TCXInfo)
-	return e
-}
-
-// Netfilter returns netfilter type-specific link info.
-//
-// Returns nil if the type-specific link info isn't available.
-func (r Info) Netfilter() *NetfilterInfo {
-	e, _ := r.extra.(*NetfilterInfo)
-	return e
-}
-
-// Netkit returns netkit type-specific link info.
-//
-// Returns nil if the type-specific link info isn't available.
-func (r Info) Netkit() *NetkitInfo {
-	e, _ := r.extra.(*NetkitInfo)
-	return e
-}
-
-// KprobeMulti returns kprobe-multi type-specific link info.
-//
-// Returns nil if the type-specific link info isn't available.
-func (r Info) KprobeMulti() *KprobeMultiInfo {
-	e, _ := r.extra.(*KprobeMultiInfo)
-	return e
-}
-
-// PerfEvent returns perf-event type-specific link info.
-//
-// Returns nil if the type-specific link info isn't available.
-func (r Info) PerfEvent() *PerfEventInfo {
-	e, _ := r.extra.(*PerfEventInfo)
-	return e
-}
-
 // RawLink is the low-level API to bpf_link.
 //
 // You should consider using the higher level interfaces in this
@@ -321,36 +127,6 @@ type RawLink struct {
 	pinnedPath string
 }
 
-// AttachRawLink creates a raw link.
-func AttachRawLink(opts RawLinkOptions) (*RawLink, error) {
-	if err := haveBPFLink(); err != nil {
-		return nil, err
-	}
-
-	if opts.Target < 0 {
-		return nil, fmt.Errorf("invalid target: %s", sys.ErrClosedFd)
-	}
-
-	progFd := opts.Program.FD()
-	if progFd < 0 {
-		return nil, fmt.Errorf("invalid program: %s", sys.ErrClosedFd)
-	}
-
-	attr := sys.LinkCreateAttr{
-		TargetFd:    uint32(opts.Target),
-		ProgFd:      uint32(progFd),
-		AttachType:  sys.AttachType(opts.Attach),
-		TargetBtfId: opts.BTF,
-		Flags:       opts.Flags,
-	}
-	fd, err := sys.LinkCreate(&attr)
-	if err != nil {
-		return nil, fmt.Errorf("create link: %w", err)
-	}
-
-	return &RawLink{fd, ""}, nil
-}
-
 func loadPinnedRawLink(fileName string, opts *ebpf.LoadPinOptions) (*RawLink, error) {
 	fd, typ, err := sys.ObjGetTyped(&sys.ObjGetAttr{
 		Pathname:  sys.NewStringPointer(fileName),
@@ -443,7 +219,10 @@ func (l *RawLink) UpdateArgs(opts RawLinkUpdateOptions) error {
 		OldProgFd: uint32(oldFd),
 		Flags:     opts.Flags,
 	}
-	return sys.LinkUpdate(&attr)
+	if err := sys.LinkUpdate(&attr); err != nil {
+		return fmt.Errorf("update link: %w", err)
+	}
+	return nil
 }
 
 // Info returns metadata about the link.
diff --git a/vendor/github.com/cilium/ebpf/link/link_other.go b/vendor/github.com/cilium/ebpf/link/link_other.go
new file mode 100644
index 0000000000000000000000000000000000000000..cd9452fd8380bd1b8e78f541c7e204cc7f258e15
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/link/link_other.go
@@ -0,0 +1,260 @@
+//go:build !windows
+
+package link
+
+import (
+	"fmt"
+
+	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/platform"
+	"github.com/cilium/ebpf/internal/sys"
+)
+
+// Valid link types.
+const (
+	UnspecifiedType   = sys.BPF_LINK_TYPE_UNSPEC
+	RawTracepointType = sys.BPF_LINK_TYPE_RAW_TRACEPOINT
+	TracingType       = sys.BPF_LINK_TYPE_TRACING
+	CgroupType        = sys.BPF_LINK_TYPE_CGROUP
+	IterType          = sys.BPF_LINK_TYPE_ITER
+	NetNsType         = sys.BPF_LINK_TYPE_NETNS
+	XDPType           = sys.BPF_LINK_TYPE_XDP
+	PerfEventType     = sys.BPF_LINK_TYPE_PERF_EVENT
+	KprobeMultiType   = sys.BPF_LINK_TYPE_KPROBE_MULTI
+	TCXType           = sys.BPF_LINK_TYPE_TCX
+	UprobeMultiType   = sys.BPF_LINK_TYPE_UPROBE_MULTI
+	NetfilterType     = sys.BPF_LINK_TYPE_NETFILTER
+	NetkitType        = sys.BPF_LINK_TYPE_NETKIT
+)
+
+// AttachRawLink creates a raw link.
+func AttachRawLink(opts RawLinkOptions) (*RawLink, error) {
+	if err := haveBPFLink(); err != nil {
+		return nil, err
+	}
+
+	if opts.Target < 0 {
+		return nil, fmt.Errorf("invalid target: %s", sys.ErrClosedFd)
+	}
+
+	progFd := opts.Program.FD()
+	if progFd < 0 {
+		return nil, fmt.Errorf("invalid program: %s", sys.ErrClosedFd)
+	}
+
+	p, attachType := platform.DecodeConstant(opts.Attach)
+	if p != platform.Linux {
+		return nil, fmt.Errorf("attach type %s: %w", opts.Attach, internal.ErrNotSupportedOnOS)
+	}
+
+	attr := sys.LinkCreateAttr{
+		TargetFd:    uint32(opts.Target),
+		ProgFd:      uint32(progFd),
+		AttachType:  sys.AttachType(attachType),
+		TargetBtfId: opts.BTF,
+		Flags:       opts.Flags,
+	}
+	fd, err := sys.LinkCreate(&attr)
+	if err != nil {
+		return nil, fmt.Errorf("create link: %w", err)
+	}
+
+	return &RawLink{fd, ""}, nil
+}
+
+// wrap a RawLink in a more specific type if possible.
+//
+// The function takes ownership of raw and closes it on error.
+func wrapRawLink(raw *RawLink) (_ Link, err error) {
+	defer func() {
+		if err != nil {
+			raw.Close()
+		}
+	}()
+
+	info, err := raw.Info()
+	if err != nil {
+		return nil, err
+	}
+
+	switch info.Type {
+	case RawTracepointType:
+		return &rawTracepoint{*raw}, nil
+	case TracingType:
+		return &tracing{*raw}, nil
+	case CgroupType:
+		return &linkCgroup{*raw}, nil
+	case IterType:
+		return &Iter{*raw}, nil
+	case NetNsType:
+		return &NetNsLink{*raw}, nil
+	case KprobeMultiType:
+		return &kprobeMultiLink{*raw}, nil
+	case UprobeMultiType:
+		return &uprobeMultiLink{*raw}, nil
+	case PerfEventType:
+		return &perfEventLink{*raw, nil}, nil
+	case TCXType:
+		return &tcxLink{*raw}, nil
+	case NetfilterType:
+		return &netfilterLink{*raw}, nil
+	case NetkitType:
+		return &netkitLink{*raw}, nil
+	case XDPType:
+		return &xdpLink{*raw}, nil
+	default:
+		return raw, nil
+	}
+}
+
+type TracingInfo struct {
+	AttachType  sys.AttachType
+	TargetObjId uint32
+	TargetBtfId sys.TypeID
+}
+
+type CgroupInfo struct {
+	CgroupId   uint64
+	AttachType sys.AttachType
+	_          [4]byte
+}
+
+type NetNsInfo struct {
+	NetnsIno   uint32
+	AttachType sys.AttachType
+}
+
+type TCXInfo struct {
+	Ifindex    uint32
+	AttachType sys.AttachType
+}
+
+type XDPInfo struct {
+	Ifindex uint32
+}
+
+type NetfilterInfo struct {
+	Pf       uint32
+	Hooknum  uint32
+	Priority int32
+	Flags    uint32
+}
+
+type NetkitInfo struct {
+	Ifindex    uint32
+	AttachType sys.AttachType
+}
+
+type KprobeMultiInfo struct {
+	count  uint32
+	flags  uint32
+	missed uint64
+}
+
+// AddressCount is the number of addresses hooked by the kprobe.
+func (kpm *KprobeMultiInfo) AddressCount() (uint32, bool) {
+	return kpm.count, kpm.count > 0
+}
+
+func (kpm *KprobeMultiInfo) Flags() (uint32, bool) {
+	return kpm.flags, kpm.count > 0
+}
+
+func (kpm *KprobeMultiInfo) Missed() (uint64, bool) {
+	return kpm.missed, kpm.count > 0
+}
+
+type PerfEventInfo struct {
+	Type  sys.PerfEventType
+	extra interface{}
+}
+
+func (r *PerfEventInfo) Kprobe() *KprobeInfo {
+	e, _ := r.extra.(*KprobeInfo)
+	return e
+}
+
+type KprobeInfo struct {
+	address uint64
+	missed  uint64
+}
+
+func (kp *KprobeInfo) Address() (uint64, bool) {
+	return kp.address, kp.address > 0
+}
+
+func (kp *KprobeInfo) Missed() (uint64, bool) {
+	return kp.missed, kp.address > 0
+}
+
+// Tracing returns tracing type-specific link info.
+//
+// Returns nil if the type-specific link info isn't available.
+func (r Info) Tracing() *TracingInfo {
+	e, _ := r.extra.(*TracingInfo)
+	return e
+}
+
+// Cgroup returns cgroup type-specific link info.
+//
+// Returns nil if the type-specific link info isn't available.
+func (r Info) Cgroup() *CgroupInfo {
+	e, _ := r.extra.(*CgroupInfo)
+	return e
+}
+
+// NetNs returns netns type-specific link info.
+//
+// Returns nil if the type-specific link info isn't available.
+func (r Info) NetNs() *NetNsInfo {
+	e, _ := r.extra.(*NetNsInfo)
+	return e
+}
+
+// XDP returns XDP type-specific link info.
+//
+// Returns nil if the type-specific link info isn't available.
+func (r Info) XDP() *XDPInfo {
+	e, _ := r.extra.(*XDPInfo)
+	return e
+}
+
+// TCX returns TCX type-specific link info.
+//
+// Returns nil if the type-specific link info isn't available.
+func (r Info) TCX() *TCXInfo {
+	e, _ := r.extra.(*TCXInfo)
+	return e
+}
+
+// Netfilter returns netfilter type-specific link info.
+//
+// Returns nil if the type-specific link info isn't available.
+func (r Info) Netfilter() *NetfilterInfo {
+	e, _ := r.extra.(*NetfilterInfo)
+	return e
+}
+
+// Netkit returns netkit type-specific link info.
+//
+// Returns nil if the type-specific link info isn't available.
+func (r Info) Netkit() *NetkitInfo {
+	e, _ := r.extra.(*NetkitInfo)
+	return e
+}
+
+// KprobeMulti returns kprobe-multi type-specific link info.
+//
+// Returns nil if the type-specific link info isn't available.
+func (r Info) KprobeMulti() *KprobeMultiInfo {
+	e, _ := r.extra.(*KprobeMultiInfo)
+	return e
+}
+
+// PerfEvent returns perf-event type-specific link info.
+//
+// Returns nil if the type-specific link info isn't available.
+func (r Info) PerfEvent() *PerfEventInfo {
+	e, _ := r.extra.(*PerfEventInfo)
+	return e
+}
diff --git a/vendor/github.com/cilium/ebpf/link/link_windows.go b/vendor/github.com/cilium/ebpf/link/link_windows.go
new file mode 100644
index 0000000000000000000000000000000000000000..d9c6f889053c4642c62cf514da8dbc64fa57d734
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/link/link_windows.go
@@ -0,0 +1,48 @@
+package link
+
+import (
+	"fmt"
+
+	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/efw"
+	"github.com/cilium/ebpf/internal/platform"
+	"github.com/cilium/ebpf/internal/sys"
+)
+
+// AttachRawLink creates a raw link.
+func AttachRawLink(opts RawLinkOptions) (*RawLink, error) {
+	if opts.Target != 0 || opts.BTF != 0 || opts.Flags != 0 {
+		return nil, fmt.Errorf("specified option(s) %w", internal.ErrNotSupportedOnOS)
+	}
+
+	plat, attachType := platform.DecodeConstant(opts.Attach)
+	if plat != platform.Windows {
+		return nil, fmt.Errorf("attach type %s: %w", opts.Attach, internal.ErrNotSupportedOnOS)
+	}
+
+	attachTypeGUID, err := efw.EbpfGetEbpfAttachType(attachType)
+	if err != nil {
+		return nil, fmt.Errorf("get attach type: %w", err)
+	}
+
+	progFd := opts.Program.FD()
+	if progFd < 0 {
+		return nil, fmt.Errorf("invalid program: %s", sys.ErrClosedFd)
+	}
+
+	raw, err := efw.EbpfProgramAttachFds(progFd, attachTypeGUID, nil, 0)
+	if err != nil {
+		return nil, fmt.Errorf("attach link: %w", err)
+	}
+
+	fd, err := sys.NewFD(int(raw))
+	if err != nil {
+		return nil, err
+	}
+
+	return &RawLink{fd: fd}, nil
+}
+
+func wrapRawLink(raw *RawLink) (Link, error) {
+	return raw, nil
+}
diff --git a/vendor/github.com/cilium/ebpf/link/netfilter.go b/vendor/github.com/cilium/ebpf/link/netfilter.go
index 9436d11df93ea427574bbf5c86852dc9269693e2..90e914c51992141bf2f08558d4184110e0b0c6a6 100644
--- a/vendor/github.com/cilium/ebpf/link/netfilter.go
+++ b/vendor/github.com/cilium/ebpf/link/netfilter.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/netkit.go b/vendor/github.com/cilium/ebpf/link/netkit.go
index 5eee3b023ae6aa4cb477fd5597255167425012d0..5e6a321af1577f43d41fff9f6e778b4943cb0ebd 100644
--- a/vendor/github.com/cilium/ebpf/link/netkit.go
+++ b/vendor/github.com/cilium/ebpf/link/netkit.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/netns.go b/vendor/github.com/cilium/ebpf/link/netns.go
index b1edd340a3fb8bbc294791c603bab64f703b3aa7..a9f7ee79c932b390e51a2fcc70f8d58456ea1fc1 100644
--- a/vendor/github.com/cilium/ebpf/link/netns.go
+++ b/vendor/github.com/cilium/ebpf/link/netns.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/perf_event.go b/vendor/github.com/cilium/ebpf/link/perf_event.go
index 7440e8b292abacf9aa6737615f301510a173139a..f1f5b84a9e30ca340fab23ef32777cd1da58475e 100644
--- a/vendor/github.com/cilium/ebpf/link/perf_event.go
+++ b/vendor/github.com/cilium/ebpf/link/perf_event.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
@@ -132,7 +134,7 @@ func (pl *perfEventLink) PerfEvent() (*os.File, error) {
 		return nil, err
 	}
 
-	return fd.File("perf-event"), nil
+	return fd.File("perf-event")
 }
 
 func (pl *perfEventLink) Info() (*Info, error) {
@@ -209,7 +211,7 @@ func (pi *perfEventIoctl) PerfEvent() (*os.File, error) {
 		return nil, err
 	}
 
-	return fd.File("perf-event"), nil
+	return fd.File("perf-event")
 }
 
 // attach the given eBPF prog to the perf event stored in pe.
diff --git a/vendor/github.com/cilium/ebpf/link/program.go b/vendor/github.com/cilium/ebpf/link/program.go
index d8a2a15f93792675c425f23d3c8fe543d8c81fcd..dbd7a9727c8ca5edc2bc228e3394a5a4facef9eb 100644
--- a/vendor/github.com/cilium/ebpf/link/program.go
+++ b/vendor/github.com/cilium/ebpf/link/program.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/query.go b/vendor/github.com/cilium/ebpf/link/query.go
index fe534f8efadbc0aecf6f21ae993eab9a02d28bac..eeca82811626aec728bc07c753a6478ecbd77335 100644
--- a/vendor/github.com/cilium/ebpf/link/query.go
+++ b/vendor/github.com/cilium/ebpf/link/query.go
@@ -1,8 +1,9 @@
+//go:build !windows
+
 package link
 
 import (
 	"fmt"
-	"unsafe"
 
 	"github.com/cilium/ebpf"
 	"github.com/cilium/ebpf/internal/sys"
@@ -84,13 +85,13 @@ func QueryPrograms(opts QueryOptions) (*QueryResult, error) {
 		AttachType:        sys.AttachType(opts.Attach),
 		QueryFlags:        opts.QueryFlags,
 		Count:             count,
-		ProgIds:           sys.NewPointer(unsafe.Pointer(&progIds[0])),
+		ProgIds:           sys.SlicePointer(progIds),
 	}
 
 	var linkIds []ID
 	if haveLinkIDs {
 		linkIds = make([]ID, count)
-		attr.LinkIds = sys.NewPointer(unsafe.Pointer(&linkIds[0]))
+		attr.LinkIds = sys.SlicePointer(linkIds)
 	}
 
 	if err := sys.ProgQuery(&attr); err != nil {
diff --git a/vendor/github.com/cilium/ebpf/link/raw_tracepoint.go b/vendor/github.com/cilium/ebpf/link/raw_tracepoint.go
index 925e621cbbc7d32da6c8b37ed115a2952ed7aa31..4be9c6a276df1106f044ab20cf52b60c1adf6e34 100644
--- a/vendor/github.com/cilium/ebpf/link/raw_tracepoint.go
+++ b/vendor/github.com/cilium/ebpf/link/raw_tracepoint.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/socket_filter.go b/vendor/github.com/cilium/ebpf/link/socket_filter.go
index 84f0b656f80a1deaafd88fe69cc40d961cacff26..8399f023157fc9465a915614b089a2176a65cd18 100644
--- a/vendor/github.com/cilium/ebpf/link/socket_filter.go
+++ b/vendor/github.com/cilium/ebpf/link/socket_filter.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/syscalls.go b/vendor/github.com/cilium/ebpf/link/syscalls.go
index 25951b017dd20528bc190621540a8f8b4f484948..9948dead414aabc68f9f26c6b1b31c4c7fa74858 100644
--- a/vendor/github.com/cilium/ebpf/link/syscalls.go
+++ b/vendor/github.com/cilium/ebpf/link/syscalls.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
@@ -10,26 +12,6 @@ import (
 	"github.com/cilium/ebpf/internal/unix"
 )
 
-// Type is the kind of link.
-type Type = sys.LinkType
-
-// Valid link types.
-const (
-	UnspecifiedType   = sys.BPF_LINK_TYPE_UNSPEC
-	RawTracepointType = sys.BPF_LINK_TYPE_RAW_TRACEPOINT
-	TracingType       = sys.BPF_LINK_TYPE_TRACING
-	CgroupType        = sys.BPF_LINK_TYPE_CGROUP
-	IterType          = sys.BPF_LINK_TYPE_ITER
-	NetNsType         = sys.BPF_LINK_TYPE_NETNS
-	XDPType           = sys.BPF_LINK_TYPE_XDP
-	PerfEventType     = sys.BPF_LINK_TYPE_PERF_EVENT
-	KprobeMultiType   = sys.BPF_LINK_TYPE_KPROBE_MULTI
-	TCXType           = sys.BPF_LINK_TYPE_TCX
-	UprobeMultiType   = sys.BPF_LINK_TYPE_UPROBE_MULTI
-	NetfilterType     = sys.BPF_LINK_TYPE_NETFILTER
-	NetkitType        = sys.BPF_LINK_TYPE_NETKIT
-)
-
 var haveProgAttach = internal.NewFeatureTest("BPF_PROG_ATTACH", func() error {
 	prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{
 		Type:    ebpf.CGroupSKB,
diff --git a/vendor/github.com/cilium/ebpf/link/tcx.go b/vendor/github.com/cilium/ebpf/link/tcx.go
index ac045b71da0e946ab870fe88ce9974d2466ac6f7..8661018ec174b1f909af3217b04f7062ab1bfe38 100644
--- a/vendor/github.com/cilium/ebpf/link/tcx.go
+++ b/vendor/github.com/cilium/ebpf/link/tcx.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/tracepoint.go b/vendor/github.com/cilium/ebpf/link/tracepoint.go
index 6fc78b98287257f5bbfd236c31565016e739d902..514961ebec9f0c5d54230f4399d2fa79d209b200 100644
--- a/vendor/github.com/cilium/ebpf/link/tracepoint.go
+++ b/vendor/github.com/cilium/ebpf/link/tracepoint.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/tracing.go b/vendor/github.com/cilium/ebpf/link/tracing.go
index a461007f9f510c7a088025dbabc2a9deaeeea997..b33b3dc0eb1defeeb9f6279ef7a7e07b2866d219 100644
--- a/vendor/github.com/cilium/ebpf/link/tracing.go
+++ b/vendor/github.com/cilium/ebpf/link/tracing.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/uprobe.go b/vendor/github.com/cilium/ebpf/link/uprobe.go
index 1852a3fadd27eb147eed7de547ab913c41324125..d20997e9d8f142c491199966ff241a29948fe96e 100644
--- a/vendor/github.com/cilium/ebpf/link/uprobe.go
+++ b/vendor/github.com/cilium/ebpf/link/uprobe.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/link/uprobe_multi.go b/vendor/github.com/cilium/ebpf/link/uprobe_multi.go
index 49dc18b44924eb57158607bcd11baa236d6eea24..e34ad7168bf0190a0f7d789f79623985fbc128e3 100644
--- a/vendor/github.com/cilium/ebpf/link/uprobe_multi.go
+++ b/vendor/github.com/cilium/ebpf/link/uprobe_multi.go
@@ -1,10 +1,11 @@
+//go:build !windows
+
 package link
 
 import (
 	"errors"
 	"fmt"
 	"os"
-	"unsafe"
 
 	"github.com/cilium/ebpf"
 	"github.com/cilium/ebpf/asm"
@@ -69,13 +70,13 @@ func (ex *Executable) uprobeMulti(symbols []string, prog *ebpf.Program, opts *Up
 	refCtrOffsets := len(opts.RefCtrOffsets)
 
 	if addrs == 0 {
-		return nil, fmt.Errorf("Addresses are required: %w", errInvalidInput)
+		return nil, fmt.Errorf("field Addresses is required: %w", errInvalidInput)
 	}
 	if refCtrOffsets > 0 && refCtrOffsets != addrs {
-		return nil, fmt.Errorf("RefCtrOffsets must be exactly Addresses in length: %w", errInvalidInput)
+		return nil, fmt.Errorf("field RefCtrOffsets must be exactly Addresses in length: %w", errInvalidInput)
 	}
 	if cookies > 0 && cookies != addrs {
-		return nil, fmt.Errorf("Cookies must be exactly Addresses in length: %w", errInvalidInput)
+		return nil, fmt.Errorf("field Cookies must be exactly Addresses in length: %w", errInvalidInput)
 	}
 
 	attr := &sys.LinkCreateUprobeMultiAttr{
@@ -84,15 +85,15 @@ func (ex *Executable) uprobeMulti(symbols []string, prog *ebpf.Program, opts *Up
 		AttachType:       sys.BPF_TRACE_UPROBE_MULTI,
 		UprobeMultiFlags: flags,
 		Count:            uint32(addrs),
-		Offsets:          sys.NewPointer(unsafe.Pointer(&addresses[0])),
+		Offsets:          sys.SlicePointer(addresses),
 		Pid:              opts.PID,
 	}
 
 	if refCtrOffsets != 0 {
-		attr.RefCtrOffsets = sys.NewPointer(unsafe.Pointer(&opts.RefCtrOffsets[0]))
+		attr.RefCtrOffsets = sys.SlicePointer(opts.RefCtrOffsets)
 	}
 	if cookies != 0 {
-		attr.Cookies = sys.NewPointer(unsafe.Pointer(&opts.Cookies[0]))
+		attr.Cookies = sys.SlicePointer(opts.Cookies)
 	}
 
 	fd, err := sys.LinkCreateUprobeMulti(attr)
@@ -201,7 +202,7 @@ var haveBPFLinkUprobeMulti = internal.NewFeatureTest("bpf_link_uprobe_multi", fu
 		ProgFd:     uint32(prog.FD()),
 		AttachType: sys.BPF_TRACE_UPROBE_MULTI,
 		Path:       sys.NewStringPointer("/"),
-		Offsets:    sys.NewPointer(unsafe.Pointer(&[]uint64{0})),
+		Offsets:    sys.SlicePointer([]uint64{0}),
 		Count:      1,
 	})
 	switch {
diff --git a/vendor/github.com/cilium/ebpf/link/xdp.go b/vendor/github.com/cilium/ebpf/link/xdp.go
index 2ec441229a51f94067c05710244e66d625a13e87..2daf0c4a226c83fdd6d274d1df4059a3a08d682d 100644
--- a/vendor/github.com/cilium/ebpf/link/xdp.go
+++ b/vendor/github.com/cilium/ebpf/link/xdp.go
@@ -1,3 +1,5 @@
+//go:build !windows
+
 package link
 
 import (
diff --git a/vendor/github.com/cilium/ebpf/linker.go b/vendor/github.com/cilium/ebpf/linker.go
index 024b72bbc829676dc2b9b204d7b4cd896abdd926..e98ad77306a7870179c53dc625bcbf9acbba8110 100644
--- a/vendor/github.com/cilium/ebpf/linker.go
+++ b/vendor/github.com/cilium/ebpf/linker.go
@@ -15,6 +15,7 @@ import (
 	"github.com/cilium/ebpf/btf"
 	"github.com/cilium/ebpf/internal"
 	"github.com/cilium/ebpf/internal/kallsyms"
+	"github.com/cilium/ebpf/internal/platform"
 )
 
 // handles stores handle objects to avoid gc cleanup
@@ -272,9 +273,11 @@ func fixupAndValidate(insns asm.Instructions) error {
 	return nil
 }
 
-// POISON_CALL_KFUNC_BASE in libbpf.
-// https://github.com/libbpf/libbpf/blob/2778cbce609aa1e2747a69349f7f46a2f94f0522/src/libbpf.c#L5767
-const kfuncCallPoisonBase = 2002000000
+// A constant used to poison calls to non-existent kfuncs.
+//
+// Similar POISON_CALL_KFUNC_BASE in libbpf, except that we use a value lower
+// than 2^28 to fit into a tagged constant.
+const kfuncCallPoisonBase = 0xdedc0de
 
 // fixupKfuncs loops over all instructions in search for kfunc calls.
 // If at least one is found, the current kernels BTF and module BTFis are searched to set Instruction.Constant
@@ -329,10 +332,12 @@ fixups:
 		if kfm.Binding == elf.STB_WEAK && errors.Is(err, btf.ErrNotFound) {
 			if ins.IsKfuncCall() {
 				// If the kfunc call is weak and not found, poison the call. Use a recognizable constant
-				// to make it easier to debug. And set src to zero so the verifier doesn't complain
-				// about the invalid imm/offset values before dead-code elimination.
-				ins.Constant = kfuncCallPoisonBase
-				ins.Src = 0
+				// to make it easier to debug.
+				fn, err := asm.BuiltinFuncForPlatform(platform.Native, kfuncCallPoisonBase)
+				if err != nil {
+					return nil, err
+				}
+				*ins = fn.Call()
 			} else if ins.OpCode.IsDWordLoad() {
 				// If the kfunc DWordLoad is weak and not found, set its address to 0.
 				ins.Constant = 0
diff --git a/vendor/github.com/cilium/ebpf/map.go b/vendor/github.com/cilium/ebpf/map.go
index e5d8bd78095030c8aafc235e809b259c4cc70cef..b2da9f6f04da2ff36767bde440a1a420553a4346 100644
--- a/vendor/github.com/cilium/ebpf/map.go
+++ b/vendor/github.com/cilium/ebpf/map.go
@@ -17,6 +17,7 @@ import (
 
 	"github.com/cilium/ebpf/btf"
 	"github.com/cilium/ebpf/internal"
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/sys"
 	"github.com/cilium/ebpf/internal/sysenc"
 	"github.com/cilium/ebpf/internal/unix"
@@ -45,12 +46,13 @@ type MapOptions struct {
 }
 
 // MapID represents the unique ID of an eBPF map
-type MapID uint32
+type MapID = sys.MapID
 
 // MapSpec defines a Map.
 type MapSpec struct {
-	// Name is passed to the kernel as a debug aid. Must only contain
-	// alpha numeric and '_' characters.
+	// Name is passed to the kernel as a debug aid.
+	//
+	// Unsupported characters will be stripped.
 	Name       string
 	Type       MapType
 	KeySize    uint32
@@ -123,8 +125,8 @@ func (ms *MapSpec) Copy() *MapSpec {
 // The copy is only performed if fixups are necessary, so callers mustn't mutate
 // the returned spec.
 func (spec *MapSpec) fixupMagicFields() (*MapSpec, error) {
-	switch spec.Type {
-	case ArrayOfMaps, HashOfMaps:
+	switch {
+	case spec.Type.canStoreMap():
 		if spec.ValueSize != 0 && spec.ValueSize != 4 {
 			return nil, errors.New("ValueSize must be zero or four for map of map")
 		}
@@ -132,7 +134,7 @@ func (spec *MapSpec) fixupMagicFields() (*MapSpec, error) {
 		spec = spec.Copy()
 		spec.ValueSize = 4
 
-	case PerfEventArray:
+	case spec.Type == PerfEventArray:
 		if spec.KeySize != 0 && spec.KeySize != 4 {
 			return nil, errors.New("KeySize must be zero or four for perf event array")
 		}
@@ -159,7 +161,7 @@ func (spec *MapSpec) fixupMagicFields() (*MapSpec, error) {
 			spec.MaxEntries = n
 		}
 
-	case CPUMap:
+	case spec.Type == CPUMap:
 		n, err := PossibleCPU()
 		if err != nil {
 			return nil, fmt.Errorf("fixup cpu map: %w", err)
@@ -236,11 +238,16 @@ func (ms *MapSpec) Compatible(m *Map) error {
 		diffs = append(diffs, fmt.Sprintf("MaxEntries: %d changed to %d", m.maxEntries, ms.MaxEntries))
 	}
 
-	// BPF_F_RDONLY_PROG is set unconditionally for devmaps. Explicitly allow this
-	// mismatch.
-	if !((ms.Type == DevMap || ms.Type == DevMapHash) && m.flags^ms.Flags == sys.BPF_F_RDONLY_PROG) &&
-		m.flags != ms.Flags {
-		diffs = append(diffs, fmt.Sprintf("Flags: %d changed to %d", m.flags, ms.Flags))
+	flags := ms.Flags
+	if ms.Type == DevMap || ms.Type == DevMapHash {
+		// As of 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
+		// BPF_F_RDONLY_PROG is set unconditionally for devmaps. Explicitly
+		// allow this mismatch.
+		flags |= (m.flags & sys.BPF_F_RDONLY_PROG)
+	}
+
+	if m.flags != flags {
+		diffs = append(diffs, fmt.Sprintf("Flags: %d changed to %d", m.flags, flags))
 	}
 
 	if len(diffs) == 0 {
@@ -293,7 +300,7 @@ func newMapFromFD(fd *sys.FD) (*Map, error) {
 		return nil, fmt.Errorf("get map info: %w", err)
 	}
 
-	return newMap(fd, info.Name, info.Type, info.KeySize, info.ValueSize, info.MaxEntries, info.Flags)
+	return newMapFromParts(fd, info.Name, info.Type, info.KeySize, info.ValueSize, info.MaxEntries, info.Flags)
 }
 
 // NewMap creates a new Map.
@@ -368,7 +375,7 @@ func newMapWithOptions(spec *MapSpec, opts MapOptions) (_ *Map, err error) {
 	}
 
 	var innerFd *sys.FD
-	if spec.Type == ArrayOfMaps || spec.Type == HashOfMaps {
+	if spec.Type.canStoreMap() {
 		if spec.InnerMap == nil {
 			return nil, fmt.Errorf("%s requires InnerMap", spec.Type)
 		}
@@ -474,8 +481,14 @@ func (spec *MapSpec) createMap(inner *sys.FD) (_ *Map, err error) {
 		return nil, err
 	}
 
+	p, sysMapType := platform.DecodeConstant(spec.Type)
+	if p != platform.Native {
+		return nil, fmt.Errorf("map type %s (%s): %w", spec.Type, p, internal.ErrNotSupportedOnOS)
+	}
+
 	attr := sys.MapCreateAttr{
-		MapType:    sys.MapType(spec.Type),
+		MapName:    maybeFillObjName(spec.Name),
+		MapType:    sys.MapType(sysMapType),
 		KeySize:    spec.KeySize,
 		ValueSize:  spec.ValueSize,
 		MaxEntries: spec.MaxEntries,
@@ -487,10 +500,6 @@ func (spec *MapSpec) createMap(inner *sys.FD) (_ *Map, err error) {
 		attr.InnerMapFd = inner.Uint()
 	}
 
-	if haveObjName() == nil {
-		attr.MapName = sys.NewObjName(spec.Name)
-	}
-
 	if spec.Key != nil || spec.Value != nil {
 		handle, keyTypeID, valueTypeID, err := btf.MarshalMapKV(spec.Key, spec.Value)
 		if err != nil && !errors.Is(err, btf.ErrNotSupported) {
@@ -520,7 +529,7 @@ func (spec *MapSpec) createMap(inner *sys.FD) (_ *Map, err error) {
 	}
 
 	defer closeOnError(fd)
-	m, err := newMap(fd, spec.Name, spec.Type, spec.KeySize, spec.ValueSize, spec.MaxEntries, spec.Flags)
+	m, err := newMapFromParts(fd, spec.Name, spec.Type, spec.KeySize, spec.ValueSize, spec.MaxEntries, spec.Flags)
 	if err != nil {
 		return nil, fmt.Errorf("map create: %w", err)
 	}
@@ -528,6 +537,14 @@ func (spec *MapSpec) createMap(inner *sys.FD) (_ *Map, err error) {
 }
 
 func handleMapCreateError(attr sys.MapCreateAttr, spec *MapSpec, err error) error {
+	if platform.IsWindows {
+		if errors.Is(err, unix.EINVAL) && attr.MapFlags != 0 {
+			return fmt.Errorf("map create: flags: %w", internal.ErrNotSupportedOnOS)
+		}
+
+		return err
+	}
+
 	if errors.Is(err, unix.EPERM) {
 		return fmt.Errorf("map create: %w (MEMLOCK may be too low, consider rlimit.RemoveMemlock)", err)
 	}
@@ -580,9 +597,9 @@ func handleMapCreateError(attr sys.MapCreateAttr, spec *MapSpec, err error) erro
 	return fmt.Errorf("map create: %w", err)
 }
 
-// newMap allocates and returns a new Map structure.
+// newMapFromParts allocates and returns a new Map structure.
 // Sets the fullValueSize on per-CPU maps.
-func newMap(fd *sys.FD, name string, typ MapType, keySize, valueSize, maxEntries, flags uint32) (*Map, error) {
+func newMapFromParts(fd *sys.FD, name string, typ MapType, keySize, valueSize, maxEntries, flags uint32) (*Map, error) {
 	m := &Map{
 		name,
 		fd,
@@ -739,7 +756,7 @@ func (m *Map) LookupAndDeleteWithFlags(key, valueOut interface{}, flags MapLooku
 // Returns a nil value if a key doesn't exist.
 func (m *Map) LookupBytes(key interface{}) ([]byte, error) {
 	valueBytes := make([]byte, m.fullValueSize)
-	valuePtr := sys.NewSlicePointer(valueBytes)
+	valuePtr := sys.UnsafeSlicePointer(valueBytes)
 
 	err := m.lookup(key, valuePtr, 0)
 	if errors.Is(err, ErrKeyNotExist) {
@@ -755,7 +772,7 @@ func (m *Map) lookupPerCPU(key, valueOut any, flags MapLookupFlags) error {
 		return err
 	}
 	valueBytes := make([]byte, m.fullValueSize)
-	if err := m.lookup(key, sys.NewSlicePointer(valueBytes), flags); err != nil {
+	if err := m.lookup(key, sys.UnsafeSlicePointer(valueBytes), flags); err != nil {
 		return err
 	}
 	return unmarshalPerCPUValue(slice, int(m.valueSize), valueBytes)
@@ -789,7 +806,7 @@ func (m *Map) lookupAndDeletePerCPU(key, valueOut any, flags MapLookupFlags) err
 		return err
 	}
 	valueBytes := make([]byte, m.fullValueSize)
-	if err := m.lookupAndDelete(key, sys.NewSlicePointer(valueBytes), flags); err != nil {
+	if err := m.lookupAndDelete(key, sys.UnsafeSlicePointer(valueBytes), flags); err != nil {
 		return err
 	}
 	return unmarshalPerCPUValue(slice, int(m.valueSize), valueBytes)
@@ -966,7 +983,7 @@ func (m *Map) NextKey(key, nextKeyOut interface{}) error {
 // Returns nil if there are no more keys.
 func (m *Map) NextKeyBytes(key interface{}) ([]byte, error) {
 	nextKey := make([]byte, m.keySize)
-	nextKeyPtr := sys.NewSlicePointer(nextKey)
+	nextKeyPtr := sys.UnsafeSlicePointer(nextKey)
 
 	err := m.nextKey(key, nextKeyPtr)
 	if errors.Is(err, ErrKeyNotExist) {
@@ -998,7 +1015,7 @@ func (m *Map) nextKey(key interface{}, nextKeyOut sys.Pointer) error {
 	if err = sys.MapGetNextKey(&attr); err != nil {
 		// Kernels 4.4.131 and earlier return EFAULT instead of a pointer to the
 		// first map element when a nil key pointer is specified.
-		if key == nil && errors.Is(err, unix.EFAULT) {
+		if platform.IsLinux && key == nil && errors.Is(err, unix.EFAULT) {
 			var guessKey []byte
 			guessKey, err = m.guessNonExistentKey()
 			if err != nil {
@@ -1006,7 +1023,7 @@ func (m *Map) nextKey(key interface{}, nextKeyOut sys.Pointer) error {
 			}
 
 			// Retry the syscall with a valid non-existing key.
-			attr.Key = sys.NewSlicePointer(guessKey)
+			attr.Key = sys.UnsafeSlicePointer(guessKey)
 			if err = sys.MapGetNextKey(&attr); err == nil {
 				return nil
 			}
@@ -1032,7 +1049,7 @@ func (m *Map) guessNonExistentKey() ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	valuePtr := sys.NewSlicePointer(page)
+	valuePtr := sys.UnsafeSlicePointer(page)
 
 	randKey := make([]byte, int(m.keySize))
 
@@ -1159,11 +1176,11 @@ func (m *Map) batchLookupPerCPU(cmd sys.Cmd, cursor *MapBatchCursor, keysOut, va
 	}
 
 	valueBuf := make([]byte, count*int(m.fullValueSize))
-	valuePtr := sys.NewSlicePointer(valueBuf)
+	valuePtr := sys.UnsafeSlicePointer(valueBuf)
 
 	n, sysErr := m.batchLookupCmd(cmd, cursor, count, keysOut, valuePtr, opts)
 	if sysErr != nil && !errors.Is(sysErr, unix.ENOENT) {
-		return 0, err
+		return 0, sysErr
 	}
 
 	err = unmarshalBatchPerCPUValue(valuesOut, count, int(m.valueSize), valueBuf)
@@ -1211,8 +1228,8 @@ func (m *Map) batchLookupCmd(cmd sys.Cmd, cursor *MapBatchCursor, count int, key
 		Keys:     keyBuf.Pointer(),
 		Values:   valuePtr,
 		Count:    uint32(count),
-		InBatch:  sys.NewSlicePointer(inBatch),
-		OutBatch: sys.NewSlicePointer(cursor.opaque),
+		InBatch:  sys.UnsafeSlicePointer(inBatch),
+		OutBatch: sys.UnsafeSlicePointer(cursor.opaque),
 	}
 
 	if opts != nil {
@@ -1294,7 +1311,7 @@ func (m *Map) batchUpdatePerCPU(keys, values any, opts *BatchOptions) (int, erro
 		return 0, err
 	}
 
-	return m.batchUpdate(count, keys, sys.NewSlicePointer(valueBuf), opts)
+	return m.batchUpdate(count, keys, sys.UnsafeSlicePointer(valueBuf), opts)
 }
 
 // BatchDelete batch deletes entries in the map by keys.
@@ -1483,7 +1500,7 @@ func (m *Map) marshalKey(data interface{}) (sys.Pointer, error) {
 	if data == nil {
 		if m.keySize == 0 {
 			// Queues have a key length of zero, so passing nil here is valid.
-			return sys.NewPointer(nil), nil
+			return sys.UnsafePointer(nil), nil
 		}
 		return sys.Pointer{}, errors.New("can't use nil as key of map")
 	}
@@ -1518,7 +1535,7 @@ func (m *Map) marshalValue(data interface{}) (sys.Pointer, error) {
 		return sys.Pointer{}, err
 	}
 
-	return sys.NewSlicePointer(buf), nil
+	return sys.UnsafeSlicePointer(buf), nil
 }
 
 func (m *Map) unmarshalValue(value any, buf sysenc.Buffer) error {
diff --git a/vendor/github.com/cilium/ebpf/marshalers.go b/vendor/github.com/cilium/ebpf/marshalers.go
index 57a0a8e88af68a7ce2f800b6f218999bd44ab567..d4e719c601e25dddb6c60e1e0d6fd3b430c4c0cf 100644
--- a/vendor/github.com/cilium/ebpf/marshalers.go
+++ b/vendor/github.com/cilium/ebpf/marshalers.go
@@ -20,7 +20,7 @@ import (
 // unsafe.Pointer.
 func marshalMapSyscallInput(data any, length int) (sys.Pointer, error) {
 	if ptr, ok := data.(unsafe.Pointer); ok {
-		return sys.NewPointer(ptr), nil
+		return sys.UnsafePointer(ptr), nil
 	}
 
 	buf, err := sysenc.Marshal(data, length)
@@ -96,7 +96,7 @@ func marshalPerCPUValue(slice any, elemLength int) (sys.Pointer, error) {
 		return sys.Pointer{}, err
 	}
 
-	return sys.NewSlicePointer(buf), nil
+	return sys.UnsafeSlicePointer(buf), nil
 }
 
 // marshalBatchPerCPUValue encodes a batch-sized slice of slices containing
diff --git a/vendor/github.com/cilium/ebpf/memory.go b/vendor/github.com/cilium/ebpf/memory.go
index 312c967131a37906b553f91ccb08abf16ce800d2..a48fe68be25671d32ed29520d15269a1e9360222 100644
--- a/vendor/github.com/cilium/ebpf/memory.go
+++ b/vendor/github.com/cilium/ebpf/memory.go
@@ -89,7 +89,10 @@ func (mm *Memory) ReadOnly() bool {
 
 // bounds returns true if an access at off of the given size is within bounds.
 func (mm *Memory) bounds(off uint64, size uint64) bool {
-	return off+size < uint64(len(mm.b))
+	if off+size < off {
+		return false
+	}
+	return off+size <= uint64(len(mm.b))
 }
 
 // ReadAt implements [io.ReaderAt]. Useful for creating a new [io.OffsetWriter].
diff --git a/vendor/github.com/cilium/ebpf/prog.go b/vendor/github.com/cilium/ebpf/prog.go
index 8fcae6a3fbe69a68e5e3f1e4b52318a12b400f3d..ebad9cfe6a81838a1899ee907519ce344bbd4547 100644
--- a/vendor/github.com/cilium/ebpf/prog.go
+++ b/vendor/github.com/cilium/ebpf/prog.go
@@ -8,15 +8,14 @@ import (
 	"math"
 	"path/filepath"
 	"runtime"
-	"strings"
 	"time"
-	"unsafe"
 
 	"github.com/cilium/ebpf/asm"
 	"github.com/cilium/ebpf/btf"
 	"github.com/cilium/ebpf/internal"
 	"github.com/cilium/ebpf/internal/kallsyms"
 	"github.com/cilium/ebpf/internal/linux"
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/sys"
 	"github.com/cilium/ebpf/internal/sysenc"
 	"github.com/cilium/ebpf/internal/unix"
@@ -38,7 +37,7 @@ var errBadRelocation = errors.New("bad CO-RE relocation")
 var errUnknownKfunc = errors.New("unknown kfunc")
 
 // ProgramID represents the unique ID of an eBPF program.
-type ProgramID uint32
+type ProgramID = sys.ProgramID
 
 const (
 	// Number of bytes to pad the output buffer for BPF_PROG_TEST_RUN.
@@ -56,6 +55,12 @@ const minVerifierLogSize = 64 * 1024
 // future, but avoid the unnecessary EINVAL for now.
 const maxVerifierLogSize = math.MaxUint32 >> 2
 
+// maxVerifierAttempts is the maximum number of times the verifier will retry
+// loading a program with a growing log buffer before giving up. Since we double
+// the log size on every attempt, this is the absolute maximum number of
+// attempts before the buffer reaches [maxVerifierLogSize].
+const maxVerifierAttempts = 30
+
 // ProgramOptions control loading a program into the kernel.
 type ProgramOptions struct {
 	// Bitmap controlling the detail emitted by the kernel's eBPF verifier log.
@@ -101,8 +106,9 @@ type ProgramOptions struct {
 
 // ProgramSpec defines a Program.
 type ProgramSpec struct {
-	// Name is passed to the kernel as a debug aid. Must only contain
-	// alpha numeric and '_' characters.
+	// Name is passed to the kernel as a debug aid.
+	//
+	// Unsupported characters will be stripped.
 	Name string
 
 	// Type determines at which hook in the kernel a program will run.
@@ -280,18 +286,20 @@ func newProgramWithOptions(spec *ProgramSpec, opts ProgramOptions) (*Program, er
 		kv = v.Kernel()
 	}
 
+	p, progType := platform.DecodeConstant(spec.Type)
+	if p != platform.Native {
+		return nil, fmt.Errorf("program type %s (%s): %w", spec.Type, p, internal.ErrNotSupportedOnOS)
+	}
+
 	attr := &sys.ProgLoadAttr{
-		ProgType:           sys.ProgType(spec.Type),
+		ProgName:           maybeFillObjName(spec.Name),
+		ProgType:           sys.ProgType(progType),
 		ProgFlags:          spec.Flags,
 		ExpectedAttachType: sys.AttachType(spec.AttachType),
 		License:            sys.NewStringPointer(spec.License),
 		KernVersion:        kv,
 	}
 
-	if haveObjName() == nil {
-		attr.ProgName = sys.NewObjName(spec.Name)
-	}
-
 	insns := make(asm.Instructions, len(spec.Instructions))
 	copy(insns, spec.Instructions)
 
@@ -333,11 +341,11 @@ func newProgramWithOptions(spec *ProgramSpec, opts ProgramOptions) (*Program, er
 
 		attr.FuncInfoRecSize = btf.FuncInfoSize
 		attr.FuncInfoCnt = uint32(len(fib)) / btf.FuncInfoSize
-		attr.FuncInfo = sys.NewSlicePointer(fib)
+		attr.FuncInfo = sys.SlicePointer(fib)
 
 		attr.LineInfoRecSize = btf.LineInfoSize
 		attr.LineInfoCnt = uint32(len(lib)) / btf.LineInfoSize
-		attr.LineInfo = sys.NewSlicePointer(lib)
+		attr.LineInfo = sys.SlicePointer(lib)
 	}
 
 	if !b.Empty() {
@@ -372,7 +380,7 @@ func newProgramWithOptions(spec *ProgramSpec, opts ProgramOptions) (*Program, er
 
 	if len(handles) > 0 {
 		fdArray := handles.fdArray()
-		attr.FdArray = sys.NewPointer(unsafe.Pointer(&fdArray[0]))
+		attr.FdArray = sys.SlicePointer(fdArray)
 	}
 
 	buf := bytes.NewBuffer(make([]byte, 0, insns.Size()))
@@ -382,7 +390,7 @@ func newProgramWithOptions(spec *ProgramSpec, opts ProgramOptions) (*Program, er
 	}
 
 	bytecode := buf.Bytes()
-	attr.Insns = sys.NewSlicePointer(bytecode)
+	attr.Insns = sys.SlicePointer(bytecode)
 	attr.InsnCnt = uint32(len(bytecode) / asm.InstructionSize)
 
 	if spec.AttachTarget != nil {
@@ -409,59 +417,48 @@ func newProgramWithOptions(spec *ProgramSpec, opts ProgramOptions) (*Program, er
 		}
 	}
 
-	// The caller requested a specific verifier log level. Set up the log buffer
-	// so that there is a chance of loading the program in a single shot.
-	logSize := internal.Between(opts.LogSizeStart, minVerifierLogSize, maxVerifierLogSize)
-	var logBuf []byte
-	if !opts.LogDisabled && opts.LogLevel != 0 {
-		logBuf = make([]byte, logSize)
-		attr.LogLevel = opts.LogLevel
-		attr.LogSize = uint32(len(logBuf))
-		attr.LogBuf = sys.NewSlicePointer(logBuf)
+	if platform.IsWindows && opts.LogLevel != 0 {
+		return nil, fmt.Errorf("log level: %w", internal.ErrNotSupportedOnOS)
 	}
 
-	for {
-		var fd *sys.FD
+	var logBuf []byte
+	var fd *sys.FD
+	if opts.LogDisabled {
+		// Loading with logging disabled should never retry.
 		fd, err = sys.ProgLoad(attr)
 		if err == nil {
-			return &Program{unix.ByteSliceToString(logBuf), fd, spec.Name, "", spec.Type}, nil
+			return &Program{"", fd, spec.Name, "", spec.Type}, nil
 		}
-
-		if opts.LogDisabled {
-			break
-		}
-
-		if attr.LogTrueSize != 0 && attr.LogSize >= attr.LogTrueSize {
-			// The log buffer already has the correct size.
-			break
+	} else {
+		// Only specify log size if log level is also specified. Setting size
+		// without level results in EINVAL. Level will be bumped to LogLevelBranch
+		// if the first load fails.
+		if opts.LogLevel != 0 {
+			attr.LogLevel = opts.LogLevel
+			attr.LogSize = internal.Between(opts.LogSizeStart, minVerifierLogSize, maxVerifierLogSize)
 		}
 
-		if attr.LogSize != 0 && !errors.Is(err, unix.ENOSPC) {
-			// Logging is enabled and the error is not ENOSPC, so we can infer
-			// that the log buffer is large enough.
-			break
-		}
+		attempts := 1
+		for {
+			if attr.LogLevel != 0 {
+				logBuf = make([]byte, attr.LogSize)
+				attr.LogBuf = sys.SlicePointer(logBuf)
+			}
 
-		if attr.LogLevel == 0 {
-			// Logging is not enabled but loading the program failed. Enable
-			// basic logging.
-			attr.LogLevel = LogLevelBranch
-		}
+			fd, err = sys.ProgLoad(attr)
+			if err == nil {
+				return &Program{unix.ByteSliceToString(logBuf), fd, spec.Name, "", spec.Type}, nil
+			}
 
-		// Make an educated guess how large the buffer should be by multiplying.
-		// Ensure the size doesn't overflow.
-		const factor = 2
-		logSize = internal.Between(logSize, minVerifierLogSize, maxVerifierLogSize/factor)
-		logSize *= factor
+			if !retryLogAttrs(attr, opts.LogSizeStart, err) {
+				break
+			}
 
-		if attr.LogTrueSize != 0 {
-			// The kernel has given us a hint how large the log buffer has to be.
-			logSize = attr.LogTrueSize
+			if attempts >= maxVerifierAttempts {
+				return nil, fmt.Errorf("load program: %w (bug: hit %d verifier attempts)", err, maxVerifierAttempts)
+			}
+			attempts++
 		}
-
-		logBuf = make([]byte, logSize)
-		attr.LogSize = logSize
-		attr.LogBuf = sys.NewSlicePointer(logBuf)
 	}
 
 	end := bytes.IndexByte(logBuf, 0)
@@ -511,11 +508,55 @@ func newProgramWithOptions(spec *ProgramSpec, opts ProgramOptions) (*Program, er
 	return nil, internal.ErrorWithLog("load program", err, logBuf)
 }
 
+func retryLogAttrs(attr *sys.ProgLoadAttr, startSize uint32, err error) bool {
+	if attr.LogSize == maxVerifierLogSize {
+		// Maximum buffer size reached, don't grow or retry.
+		return false
+	}
+
+	// ENOSPC means the log was enabled on the previous iteration, so we only
+	// need to grow the buffer.
+	if errors.Is(err, unix.ENOSPC) {
+		if attr.LogTrueSize != 0 {
+			// Kernel supports LogTrueSize and previous iteration undershot the buffer
+			// size. Try again with the given true size.
+			attr.LogSize = attr.LogTrueSize
+			return true
+		}
+
+		// Ensure the size doesn't overflow.
+		const factor = 2
+		if attr.LogSize >= maxVerifierLogSize/factor {
+			attr.LogSize = maxVerifierLogSize
+			return true
+		}
+
+		// Make an educated guess how large the buffer should be by multiplying. Due
+		// to int division, this rounds down odd sizes.
+		attr.LogSize = internal.Between(attr.LogSize, minVerifierLogSize, maxVerifierLogSize/factor)
+		attr.LogSize *= factor
+
+		return true
+	}
+
+	if attr.LogLevel == 0 {
+		// Loading the program failed, it wasn't a buffer-related error, and the log
+		// was disabled the previous iteration. Enable basic logging and retry.
+		attr.LogLevel = LogLevelBranch
+		attr.LogSize = internal.Between(startSize, minVerifierLogSize, maxVerifierLogSize)
+		return true
+	}
+
+	// Loading the program failed for a reason other than buffer size and the log
+	// was already enabled the previous iteration. Don't retry.
+	return false
+}
+
 // NewProgramFromFD creates a program from a raw fd.
 //
 // You should not use fd after calling this function.
 //
-// Requires at least Linux 4.10.
+// Requires at least Linux 4.10. Returns an error on Windows.
 func NewProgramFromFD(fd int) (*Program, error) {
 	f, err := sys.NewFD(fd)
 	if err != nil {
@@ -759,6 +800,10 @@ func (p *Program) Benchmark(in []byte, repeat int, reset func()) (uint32, time.D
 }
 
 var haveProgRun = internal.NewFeatureTest("BPF_PROG_RUN", func() error {
+	if platform.IsWindows {
+		return nil
+	}
+
 	prog, err := NewProgram(&ProgramSpec{
 		// SocketFilter does not require privileges on newer kernels.
 		Type: SocketFilter,
@@ -778,7 +823,7 @@ var haveProgRun = internal.NewFeatureTest("BPF_PROG_RUN", func() error {
 	attr := sys.ProgRunAttr{
 		ProgFd:     uint32(prog.FD()),
 		DataSizeIn: uint32(len(in)),
-		DataIn:     sys.NewSlicePointer(in),
+		DataIn:     sys.SlicePointer(in),
 	}
 
 	err = sys.ProgRun(&attr)
@@ -800,7 +845,7 @@ var haveProgRun = internal.NewFeatureTest("BPF_PROG_RUN", func() error {
 	}
 
 	return err
-}, "4.12")
+}, "4.12", "windows:0.20")
 
 func (p *Program) run(opts *RunOptions) (uint32, time.Duration, error) {
 	if uint(len(opts.Data)) > math.MaxUint32 {
@@ -829,13 +874,13 @@ func (p *Program) run(opts *RunOptions) (uint32, time.Duration, error) {
 		ProgFd:      p.fd.Uint(),
 		DataSizeIn:  uint32(len(opts.Data)),
 		DataSizeOut: uint32(len(opts.DataOut)),
-		DataIn:      sys.NewSlicePointer(opts.Data),
-		DataOut:     sys.NewSlicePointer(opts.DataOut),
+		DataIn:      sys.SlicePointer(opts.Data),
+		DataOut:     sys.SlicePointer(opts.DataOut),
 		Repeat:      uint32(opts.Repeat),
 		CtxSizeIn:   uint32(len(ctxBytes)),
 		CtxSizeOut:  uint32(len(ctxOut)),
-		CtxIn:       sys.NewSlicePointer(ctxBytes),
-		CtxOut:      sys.NewSlicePointer(ctxOut),
+		CtxIn:       sys.SlicePointer(ctxBytes),
+		CtxOut:      sys.SlicePointer(ctxOut),
 		Flags:       opts.Flags,
 		Cpu:         opts.CPU,
 	}
@@ -956,22 +1001,6 @@ func LoadPinnedProgram(fileName string, opts *LoadPinOptions) (*Program, error)
 	return &Program{"", fd, progName, fileName, info.Type}, nil
 }
 
-// SanitizeName replaces all invalid characters in name with replacement.
-// Passing a negative value for replacement will delete characters instead
-// of replacing them. Use this to automatically generate valid names for maps
-// and programs at runtime.
-//
-// The set of allowed characters depends on the running kernel version.
-// Dots are only allowed as of kernel 5.2.
-func SanitizeName(name string, replacement rune) string {
-	return strings.Map(func(char rune) rune {
-		if invalidBPFObjNameChar(char) {
-			return replacement
-		}
-		return char
-	}, name)
-}
-
 // ProgramGetNextID returns the ID of the next eBPF program.
 //
 // Returns ErrNotExist, if there is no next eBPF program.
diff --git a/vendor/github.com/cilium/ebpf/syscalls.go b/vendor/github.com/cilium/ebpf/syscalls.go
index 25c84c3c5c1a0112c79ba2db8f421edab7c218be..f03bed02b2387615d46279ad45a1a91bdbc148e1 100644
--- a/vendor/github.com/cilium/ebpf/syscalls.go
+++ b/vendor/github.com/cilium/ebpf/syscalls.go
@@ -7,10 +7,12 @@ import (
 	"math"
 	"os"
 	"runtime"
+	"strings"
 
 	"github.com/cilium/ebpf/asm"
 	"github.com/cilium/ebpf/internal"
 	"github.com/cilium/ebpf/internal/linux"
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/sys"
 	"github.com/cilium/ebpf/internal/tracefs"
 	"github.com/cilium/ebpf/internal/unix"
@@ -25,25 +27,41 @@ var (
 	sysErrNotSupported = sys.Error(ErrNotSupported, sys.ENOTSUPP)
 )
 
-// invalidBPFObjNameChar returns true if char may not appear in
-// a BPF object name.
-func invalidBPFObjNameChar(char rune) bool {
-	dotAllowed := objNameAllowsDot() == nil
-
-	switch {
-	case char >= 'A' && char <= 'Z':
-		return false
-	case char >= 'a' && char <= 'z':
-		return false
-	case char >= '0' && char <= '9':
-		return false
-	case dotAllowed && char == '.':
-		return false
-	case char == '_':
-		return false
-	default:
-		return true
+// sanitizeName replaces all invalid characters in name with replacement.
+// Passing a negative value for replacement will delete characters instead
+// of replacing them.
+//
+// The set of allowed characters may change over time.
+func sanitizeName(name string, replacement rune) string {
+	return strings.Map(func(char rune) rune {
+		switch {
+		case char >= 'A' && char <= 'Z':
+			return char
+		case char >= 'a' && char <= 'z':
+			return char
+		case char >= '0' && char <= '9':
+			return char
+		case char == '.':
+			return char
+		case char == '_':
+			return char
+		default:
+			return replacement
+		}
+	}, name)
+}
+
+func maybeFillObjName(name string) sys.ObjName {
+	if errors.Is(haveObjName(), ErrNotSupported) {
+		return sys.ObjName{}
+	}
+
+	name = sanitizeName(name, -1)
+	if errors.Is(objNameAllowsDot(), ErrNotSupported) {
+		name = strings.ReplaceAll(name, ".", "")
 	}
+
+	return sys.NewObjName(name)
 }
 
 func progLoad(insns asm.Instructions, typ ProgramType, license string) (*sys.FD, error) {
@@ -56,12 +74,17 @@ func progLoad(insns asm.Instructions, typ ProgramType, license string) (*sys.FD,
 	return sys.ProgLoad(&sys.ProgLoadAttr{
 		ProgType: sys.ProgType(typ),
 		License:  sys.NewStringPointer(license),
-		Insns:    sys.NewSlicePointer(bytecode),
+		Insns:    sys.SlicePointer(bytecode),
 		InsnCnt:  uint32(len(bytecode) / asm.InstructionSize),
 	})
 }
 
 var haveNestedMaps = internal.NewFeatureTest("nested maps", func() error {
+	if platform.IsWindows {
+		// We only support efW versions which have this feature, no need to probe.
+		return nil
+	}
+
 	_, err := sys.MapCreate(&sys.MapCreateAttr{
 		MapType:    sys.MapType(ArrayOfMaps),
 		KeySize:    4,
@@ -77,7 +100,7 @@ var haveNestedMaps = internal.NewFeatureTest("nested maps", func() error {
 		return nil
 	}
 	return err
-}, "4.12")
+}, "4.12", "windows:0.20.0")
 
 var haveMapMutabilityModifiers = internal.NewFeatureTest("read- and write-only maps", func() error {
 	// This checks BPF_F_RDONLY_PROG and BPF_F_WRONLY_PROG. Since
@@ -171,6 +194,11 @@ func wrapMapError(err error) error {
 }
 
 var haveObjName = internal.NewFeatureTest("object names", func() error {
+	if platform.IsWindows {
+		// We only support efW versions which have this feature, no need to probe.
+		return nil
+	}
+
 	attr := sys.MapCreateAttr{
 		MapType:    sys.MapType(Array),
 		KeySize:    4,
@@ -179,24 +207,21 @@ var haveObjName = internal.NewFeatureTest("object names", func() error {
 		MapName:    sys.NewObjName("feature_test"),
 	}
 
-	// Tolerate EPERM as this runs during ELF loading which is potentially
-	// unprivileged. Only EINVAL is conclusive, thrown from CHECK_ATTR.
 	fd, err := sys.MapCreate(&attr)
-	if errors.Is(err, unix.EPERM) {
-		return nil
-	}
-	if errors.Is(err, unix.EINVAL) {
-		return internal.ErrNotSupported
-	}
 	if err != nil {
-		return err
+		return internal.ErrNotSupported
 	}
 
 	_ = fd.Close()
 	return nil
-}, "4.15")
+}, "4.15", "windows:0.20.0")
 
 var objNameAllowsDot = internal.NewFeatureTest("dot in object names", func() error {
+	if platform.IsWindows {
+		// We only support efW versions which have this feature, no need to probe.
+		return nil
+	}
+
 	if err := haveObjName(); err != nil {
 		return err
 	}
@@ -209,23 +234,14 @@ var objNameAllowsDot = internal.NewFeatureTest("dot in object names", func() err
 		MapName:    sys.NewObjName(".test"),
 	}
 
-	// Tolerate EPERM, otherwise MapSpec.Name has its dots removed when run by
-	// unprivileged tools. (bpf2go, other code gen). Only EINVAL is conclusive,
-	// thrown from bpf_obj_name_cpy().
 	fd, err := sys.MapCreate(&attr)
-	if errors.Is(err, unix.EPERM) {
-		return nil
-	}
-	if errors.Is(err, unix.EINVAL) {
-		return internal.ErrNotSupported
-	}
 	if err != nil {
-		return err
+		return internal.ErrNotSupported
 	}
 
 	_ = fd.Close()
 	return nil
-}, "5.2")
+}, "5.2", "windows:0.20.0")
 
 var haveBatchAPI = internal.NewFeatureTest("map batch api", func() error {
 	var maxEntries uint32 = 2
@@ -337,7 +353,7 @@ var haveProgramExtInfos = internal.NewFeatureTest("program ext_infos", func() er
 	_, err := sys.ProgLoad(&sys.ProgLoadAttr{
 		ProgType:    sys.ProgType(SocketFilter),
 		License:     sys.NewStringPointer("MIT"),
-		Insns:       sys.NewSlicePointer(bytecode),
+		Insns:       sys.SlicePointer(bytecode),
 		InsnCnt:     uint32(len(bytecode) / asm.InstructionSize),
 		FuncInfoCnt: 1,
 		ProgBtfFd:   math.MaxUint32,
diff --git a/vendor/github.com/cilium/ebpf/types.go b/vendor/github.com/cilium/ebpf/types.go
index d7fb00509deaca28118c8e8b4c5275ca3684c16c..ae70e6cdbc709a7875ef7cb3dc99973d8f185cab 100644
--- a/vendor/github.com/cilium/ebpf/types.go
+++ b/vendor/github.com/cilium/ebpf/types.go
@@ -1,6 +1,7 @@
 package ebpf
 
 import (
+	"github.com/cilium/ebpf/internal/platform"
 	"github.com/cilium/ebpf/internal/sys"
 )
 
@@ -12,7 +13,7 @@ type MapType uint32
 
 // All the various map types that can be created
 const (
-	UnspecifiedMap MapType = iota
+	UnspecifiedMap MapType = MapType(platform.LinuxTag | iota)
 	// Hash is a hash map
 	Hash
 	// Array is an array map
@@ -104,9 +105,40 @@ const (
 	Arena
 )
 
+// Map types (Windows).
+const (
+	WindowsHash MapType = MapType(platform.WindowsTag | iota + 1)
+	WindowsArray
+	WindowsProgramArray
+	WindowsPerCPUHash
+	WindowsPerCPUArray
+	WindowsHashOfMaps
+	WindowsArrayOfMaps
+	WindowsLRUHash
+	WindowsLPMTrie
+	WindowsQueue
+	WindowsLRUCPUHash
+	WindowsStack
+	WindowsRingBuf
+)
+
+// MapTypeForPlatform returns a platform specific map type.
+//
+// Use this if the library doesn't provide a constant yet.
+func MapTypeForPlatform(plat string, typ uint32) (MapType, error) {
+	return platform.EncodeConstant[MapType](plat, typ)
+}
+
 // hasPerCPUValue returns true if the Map stores a value per CPU.
 func (mt MapType) hasPerCPUValue() bool {
-	return mt == PerCPUHash || mt == PerCPUArray || mt == LRUCPUHash || mt == PerCPUCGroupStorage
+	switch mt {
+	case PerCPUHash, PerCPUArray, LRUCPUHash, PerCPUCGroupStorage:
+		return true
+	case WindowsPerCPUHash, WindowsPerCPUArray, WindowsLRUCPUHash:
+		return true
+	default:
+		return false
+	}
 }
 
 // canStoreMapOrProgram returns true if the Map stores references to another Map
@@ -118,13 +150,13 @@ func (mt MapType) canStoreMapOrProgram() bool {
 // canStoreMap returns true if the map type accepts a map fd
 // for update and returns a map id for lookup.
 func (mt MapType) canStoreMap() bool {
-	return mt == ArrayOfMaps || mt == HashOfMaps
+	return mt == ArrayOfMaps || mt == HashOfMaps || mt == WindowsArrayOfMaps || mt == WindowsHashOfMaps
 }
 
 // canStoreProgram returns true if the map type accepts a program fd
 // for update and returns a program id for lookup.
 func (mt MapType) canStoreProgram() bool {
-	return mt == ProgramArray
+	return mt == ProgramArray || mt == WindowsProgramArray
 }
 
 // canHaveValueSize returns true if the map type supports setting a value size.
@@ -145,7 +177,7 @@ func (mt MapType) canHaveValueSize() bool {
 // ProgramType of the eBPF program
 type ProgramType uint32
 
-// eBPF program types
+// eBPF program types (Linux).
 const (
 	UnspecifiedProgram    = ProgramType(sys.BPF_PROG_TYPE_UNSPEC)
 	SocketFilter          = ProgramType(sys.BPF_PROG_TYPE_SOCKET_FILTER)
@@ -182,6 +214,25 @@ const (
 	Netfilter             = ProgramType(sys.BPF_PROG_TYPE_NETFILTER)
 )
 
+// eBPF program types (Windows).
+//
+// See https://github.com/microsoft/ebpf-for-windows/blob/main/include/ebpf_structs.h#L170
+const (
+	WindowsXDP ProgramType = ProgramType(platform.WindowsTag) | (iota + 1)
+	WindowsBind
+	WindowsCGroupSockAddr
+	WindowsSockOps
+	WindowsXDPTest ProgramType = ProgramType(platform.WindowsTag) | 998
+	WindowsSample  ProgramType = ProgramType(platform.WindowsTag) | 999
+)
+
+// ProgramTypeForPlatform returns a platform specific program type.
+//
+// Use this if the library doesn't provide a constant yet.
+func ProgramTypeForPlatform(plat string, value uint32) (ProgramType, error) {
+	return platform.EncodeConstant[ProgramType](plat, value)
+}
+
 // AttachType of the eBPF program, needed to differentiate allowed context accesses in
 // some newer program types like CGroupSockAddr. Should be set to AttachNone if not required.
 // Will cause invalid argument (EINVAL) at program load time if set incorrectly.
@@ -192,6 +243,7 @@ type AttachType uint32
 // AttachNone is an alias for AttachCGroupInetIngress for readability reasons.
 const AttachNone AttachType = 0
 
+// Attach types (Linux).
 const (
 	AttachCGroupInetIngress          = AttachType(sys.BPF_CGROUP_INET_INGRESS)
 	AttachCGroupInetEgress           = AttachType(sys.BPF_CGROUP_INET_EGRESS)
@@ -252,6 +304,28 @@ const (
 	AttachNetkitPeer                 = AttachType(sys.BPF_NETKIT_PEER)
 )
 
+// Attach types (Windows).
+//
+// See https://github.com/microsoft/ebpf-for-windows/blob/main/include/ebpf_structs.h#L260
+const (
+	AttachWindowsXDP = AttachType(platform.WindowsTag | iota + 1)
+	AttachWindowsBind
+	AttachWindowsCGroupInet4Connect
+	AttachWindowsCGroupInet6Connect
+	AttachWindowsCgroupInet4RecvAccept
+	AttachWindowsCgroupInet6RecvAccept
+	AttachWindowsCGroupSockOps
+	AttachWindowsSample
+	AttachWindowsXDPTest
+)
+
+// AttachTypeForPlatform returns a platform specific attach type.
+//
+// Use this if the library doesn't provide a constant yet.
+func AttachTypeForPlatform(plat string, value uint32) (AttachType, error) {
+	return platform.EncodeConstant[AttachType](plat, value)
+}
+
 // AttachFlags of the eBPF program used in BPF_PROG_ATTACH command
 type AttachFlags uint32
 
diff --git a/vendor/github.com/cilium/ebpf/types_string.go b/vendor/github.com/cilium/ebpf/types_string.go
index f06685112c243154b9cc2959f94c7bf8a1ff13c9..efcd6a7dd0c0906d16843dfa4e85e79e4e7b1905 100644
--- a/vendor/github.com/cilium/ebpf/types_string.go
+++ b/vendor/github.com/cilium/ebpf/types_string.go
@@ -42,17 +42,41 @@ func _() {
 	_ = x[UserRingbuf-31]
 	_ = x[CgroupStorage-32]
 	_ = x[Arena-33]
+	_ = x[WindowsHash-268435457]
+	_ = x[WindowsArray-268435458]
+	_ = x[WindowsProgramArray-268435459]
+	_ = x[WindowsPerCPUHash-268435460]
+	_ = x[WindowsPerCPUArray-268435461]
+	_ = x[WindowsHashOfMaps-268435462]
+	_ = x[WindowsArrayOfMaps-268435463]
+	_ = x[WindowsLRUHash-268435464]
+	_ = x[WindowsLPMTrie-268435465]
+	_ = x[WindowsQueue-268435466]
+	_ = x[WindowsLRUCPUHash-268435467]
+	_ = x[WindowsStack-268435468]
+	_ = x[WindowsRingBuf-268435469]
 }
 
-const _MapType_name = "UnspecifiedMapHashArrayProgramArrayPerfEventArrayPerCPUHashPerCPUArrayStackTraceCGroupArrayLRUHashLRUCPUHashLPMTrieArrayOfMapsHashOfMapsDevMapSockMapCPUMapXSKMapSockHashCGroupStorageReusePortSockArrayPerCPUCGroupStorageQueueStackSkStorageDevMapHashStructOpsMapRingBufInodeStorageTaskStorageBloomFilterUserRingbufCgroupStorageArena"
+const (
+	_MapType_name_0 = "UnspecifiedMapHashArrayProgramArrayPerfEventArrayPerCPUHashPerCPUArrayStackTraceCGroupArrayLRUHashLRUCPUHashLPMTrieArrayOfMapsHashOfMapsDevMapSockMapCPUMapXSKMapSockHashCGroupStorageReusePortSockArrayPerCPUCGroupStorageQueueStackSkStorageDevMapHashStructOpsMapRingBufInodeStorageTaskStorageBloomFilterUserRingbufCgroupStorageArena"
+	_MapType_name_1 = "WindowsHashWindowsArrayWindowsProgramArrayWindowsPerCPUHashWindowsPerCPUArrayWindowsHashOfMapsWindowsArrayOfMapsWindowsLRUHashWindowsLPMTrieWindowsQueueWindowsLRUCPUHashWindowsStackWindowsRingBuf"
+)
 
-var _MapType_index = [...]uint16{0, 14, 18, 23, 35, 49, 59, 70, 80, 91, 98, 108, 115, 126, 136, 142, 149, 155, 161, 169, 182, 200, 219, 224, 229, 238, 248, 260, 267, 279, 290, 301, 312, 325, 330}
+var (
+	_MapType_index_0 = [...]uint16{0, 14, 18, 23, 35, 49, 59, 70, 80, 91, 98, 108, 115, 126, 136, 142, 149, 155, 161, 169, 182, 200, 219, 224, 229, 238, 248, 260, 267, 279, 290, 301, 312, 325, 330}
+	_MapType_index_1 = [...]uint8{0, 11, 23, 42, 59, 77, 94, 112, 126, 140, 152, 169, 181, 195}
+)
 
 func (i MapType) String() string {
-	if i >= MapType(len(_MapType_index)-1) {
+	switch {
+	case i <= 33:
+		return _MapType_name_0[_MapType_index_0[i]:_MapType_index_0[i+1]]
+	case 268435457 <= i && i <= 268435469:
+		i -= 268435457
+		return _MapType_name_1[_MapType_index_1[i]:_MapType_index_1[i+1]]
+	default:
 		return "MapType(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _MapType_name[_MapType_index[i]:_MapType_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
@@ -91,17 +115,39 @@ func _() {
 	_ = x[SkLookup-30]
 	_ = x[Syscall-31]
 	_ = x[Netfilter-32]
+	_ = x[WindowsXDP-268435457]
+	_ = x[WindowsBind-268435458]
+	_ = x[WindowsCGroupSockAddr-268435459]
+	_ = x[WindowsSockOps-268435460]
+	_ = x[WindowsXDPTest-268436454]
+	_ = x[WindowsSample-268436455]
 }
 
-const _ProgramType_name = "UnspecifiedProgramSocketFilterKprobeSchedCLSSchedACTTracePointXDPPerfEventCGroupSKBCGroupSockLWTInLWTOutLWTXmitSockOpsSkSKBCGroupDeviceSkMsgRawTracepointCGroupSockAddrLWTSeg6LocalLircMode2SkReuseportFlowDissectorCGroupSysctlRawTracepointWritableCGroupSockoptTracingStructOpsExtensionLSMSkLookupSyscallNetfilter"
+const (
+	_ProgramType_name_0 = "UnspecifiedProgramSocketFilterKprobeSchedCLSSchedACTTracePointXDPPerfEventCGroupSKBCGroupSockLWTInLWTOutLWTXmitSockOpsSkSKBCGroupDeviceSkMsgRawTracepointCGroupSockAddrLWTSeg6LocalLircMode2SkReuseportFlowDissectorCGroupSysctlRawTracepointWritableCGroupSockoptTracingStructOpsExtensionLSMSkLookupSyscallNetfilter"
+	_ProgramType_name_1 = "WindowsXDPWindowsBindWindowsCGroupSockAddrWindowsSockOps"
+	_ProgramType_name_2 = "WindowsXDPTestWindowsSample"
+)
 
-var _ProgramType_index = [...]uint16{0, 18, 30, 36, 44, 52, 62, 65, 74, 83, 93, 98, 104, 111, 118, 123, 135, 140, 153, 167, 179, 188, 199, 212, 224, 245, 258, 265, 274, 283, 286, 294, 301, 310}
+var (
+	_ProgramType_index_0 = [...]uint16{0, 18, 30, 36, 44, 52, 62, 65, 74, 83, 93, 98, 104, 111, 118, 123, 135, 140, 153, 167, 179, 188, 199, 212, 224, 245, 258, 265, 274, 283, 286, 294, 301, 310}
+	_ProgramType_index_1 = [...]uint8{0, 10, 21, 42, 56}
+	_ProgramType_index_2 = [...]uint8{0, 14, 27}
+)
 
 func (i ProgramType) String() string {
-	if i >= ProgramType(len(_ProgramType_index)-1) {
+	switch {
+	case i <= 32:
+		return _ProgramType_name_0[_ProgramType_index_0[i]:_ProgramType_index_0[i+1]]
+	case 268435457 <= i && i <= 268435460:
+		i -= 268435457
+		return _ProgramType_name_1[_ProgramType_index_1[i]:_ProgramType_index_1[i+1]]
+	case 268436454 <= i && i <= 268436455:
+		i -= 268436454
+		return _ProgramType_name_2[_ProgramType_index_2[i]:_ProgramType_index_2[i+1]]
+	default:
 		return "ProgramType(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _ProgramType_name[_ProgramType_index[i]:_ProgramType_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
diff --git a/vendor/github.com/cilium/ebpf/types_windows.go b/vendor/github.com/cilium/ebpf/types_windows.go
new file mode 100644
index 0000000000000000000000000000000000000000..0b7e836b0dc29e8eab6a73b865d3c88202310bf5
--- /dev/null
+++ b/vendor/github.com/cilium/ebpf/types_windows.go
@@ -0,0 +1,57 @@
+package ebpf
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/sys/windows"
+
+	"github.com/cilium/ebpf/internal/efw"
+	"github.com/cilium/ebpf/internal/platform"
+)
+
+// WindowsProgramTypeForGUID resolves a GUID to a ProgramType.
+//
+// The GUID must be in the form of "{XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}".
+//
+// Returns an error wrapping [os.ErrNotExist] if the GUID is not recignized.
+func WindowsProgramTypeForGUID(guid string) (ProgramType, error) {
+	progTypeGUID, err := windows.GUIDFromString(guid)
+	if err != nil {
+		return 0, fmt.Errorf("parse GUID: %w", err)
+	}
+
+	rawProgramType, err := efw.EbpfGetBpfProgramType(progTypeGUID)
+	if err != nil {
+		return 0, fmt.Errorf("get program type: %w", err)
+	}
+
+	if rawProgramType == 0 {
+		return 0, fmt.Errorf("program type not found for GUID %v: %w", guid, os.ErrNotExist)
+	}
+
+	return ProgramTypeForPlatform(platform.Windows, rawProgramType)
+}
+
+// WindowsAttachTypeForGUID resolves a GUID to an AttachType.
+//
+// The GUID must be in the form of "{XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}".
+//
+// Returns an error wrapping [os.ErrNotExist] if the GUID is not recignized.
+func WindowsAttachTypeForGUID(guid string) (AttachType, error) {
+	attachTypeGUID, err := windows.GUIDFromString(guid)
+	if err != nil {
+		return 0, fmt.Errorf("parse GUID: %w", err)
+	}
+
+	rawAttachType, err := efw.EbpfGetBpfAttachType(attachTypeGUID)
+	if err != nil {
+		return 0, fmt.Errorf("get attach type: %w", err)
+	}
+
+	if rawAttachType == 0 {
+		return 0, fmt.Errorf("attach type not found for GUID %v: %w", attachTypeGUID, os.ErrNotExist)
+	}
+
+	return AttachTypeForPlatform(platform.Windows, rawAttachType)
+}
diff --git a/vendor/github.com/cilium/ebpf/variable.go b/vendor/github.com/cilium/ebpf/variable.go
index 288b173a11542523fb7087503bb5e3ac77fdd187..f4f0dd76f290a6a6599c4585a88124a3ae2809b7 100644
--- a/vendor/github.com/cilium/ebpf/variable.go
+++ b/vendor/github.com/cilium/ebpf/variable.go
@@ -199,6 +199,10 @@ func (v *Variable) Set(in any) error {
 		return fmt.Errorf("variable %s: %w", v.name, ErrReadOnly)
 	}
 
+	if !v.mm.bounds(v.offset, v.size) {
+		return fmt.Errorf("variable %s: access out of bounds: %w", v.name, io.EOF)
+	}
+
 	buf, err := sysenc.Marshal(in, int(v.size))
 	if err != nil {
 		return fmt.Errorf("marshaling value %s: %w", v.name, err)
diff --git a/vendor/modules.txt b/vendor/modules.txt
index ece189761bcaa5ff78a9a720c212daa2c031bcb3..8ccdd81e7c795fafc96988efe87147be6d5759cb 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -42,19 +42,21 @@ github.com/cenkalti/rpc2/jsonrpc
 # github.com/cespare/xxhash/v2 v2.3.0
 ## explicit; go 1.11
 github.com/cespare/xxhash/v2
-# github.com/cilium/ebpf v0.17.3
-## explicit; go 1.22
+# github.com/cilium/ebpf v0.18.0
+## explicit; go 1.23.0
 github.com/cilium/ebpf
 github.com/cilium/ebpf/asm
 github.com/cilium/ebpf/btf
 github.com/cilium/ebpf/internal
+github.com/cilium/ebpf/internal/efw
 github.com/cilium/ebpf/internal/epoll
 github.com/cilium/ebpf/internal/kallsyms
 github.com/cilium/ebpf/internal/kconfig
 github.com/cilium/ebpf/internal/linux
+github.com/cilium/ebpf/internal/platform
 github.com/cilium/ebpf/internal/sys
 github.com/cilium/ebpf/internal/sysenc
-github.com/cilium/ebpf/internal/testutils/fdtrace
+github.com/cilium/ebpf/internal/testutils/testmain
 github.com/cilium/ebpf/internal/tracefs
 github.com/cilium/ebpf/internal/unix
 github.com/cilium/ebpf/link