This looks like socket vs socketcall that is common to 32bit architectures. CC @jdstrand
EDIT: What I mean by this is that some kernels had socket and some kernels had socketcall. Seccomp libshould make that transparent for us but perhaps it is buggy somewhere.