wprobe: the bpf code expects direct-access fields to be in big endian, not cpu endian