BPF filtering accesses fields in the netlink header that are only filled in by libudev, never by the kernel. Therefore adding BPF filters for kernel monitors is pointless. Even false filtering of kernel events might be possible; at least it's hard to prove that it can't occur.