Wow! Mighty quick work Vincenzo. Thanks for the prompt response. I've done a fairly thorough test of the patches: - builds OK - boots OK - Base ABI application is able to use dev/net/tun for VPN communication, including ioctl calls. - Purecap ABI test application is able to open dev/net/tun and make an ioctl call without error. I don't have my full VPN application running purecap yet, but built a small C test harness for this. - anti-test: Purecap ABI test application running on Debian version WITHOUT the patch (but with my hack described in original post) is able to open dev/net/tun but ioctl returns an error.