Well I think that a function or system call semantics replacement facility would be useful to unit testers everywhere. It would be benign of course, requiring that the unit testing framework request of the kernel that it replace the kernel facilities specified prior to the test, and automatically replace them afterward. So, this isn't anything akin to doing anything malicious, it requires user cooperation in order to hook. It's not like something forcibly done. I'm thinking of an intel pin for kernel level code.